What is CVE-2021-37678?

CVE-2021-37678 is a critical-severity vulnerability in Tensorflow, classified under Deserialization of Untrusted Data. CVSS score: 9.3/10. Published 2021-08-12.

How severe is CVE-2021-37678?

Critical severity. CVSS v3 base score is 9.3 out of 10.

Is CVE-2021-37678 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Tensorflow

CVE-2021-37678

TensorFlow is an end-to-end open source platform for machine learning. In affected versions TensorFlow and Keras can be tricked to perform arbitrary code execution when deserializing a Keras model from YAML format. The [implementation](htt…

Vulnerability class: Insecure Deserialization

EPSS: 0.010 (77.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Tensorflow — versions >= 2.5.0, < 2.5.1, >= 2.4.0, < 2.4.3, < 2.3.4

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

References

github.com/tensorflow/tensorflow/security/advisories/GHSA-r6jx-9g48-2r5r (x_refsource_CONFIRM)
github.com/tensorflow/tensorflow/commit/23d6383eb6c14084a8fc3bdf164043b974818012 (x_refsource_MISC)

Frequently asked questions

What is CVE-2021-37678?: CVE-2021-37678 is a critical-severity vulnerability in Tensorflow, classified under Deserialization of Untrusted Data. CVSS score: 9.3/10. Published 2021-08-12.
How severe is CVE-2021-37678?: Critical severity. CVSS v3 base score is 9.3 out of 10.
Is CVE-2021-37678 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.