CVE-2021-33430 NumPy Buffer Overflow (Disputed)

What is CVE-2021-33430?

CVE-2021-33430 is a medium-severity memory corruption vulnerability in n/a, published on 17 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulneraility; In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user

Weakness: CWE-120

Which versions are affected by CVE-2021-33430?

3 open source packages ship an affected version, including numpy. It affects 1 product.

Products include Numpy Numpy.

How do I fix CVE-2021-33430?

Upgrade numpy to a fixed version for your release line: 1.10.0 or 1.21.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-33430 being exploited?

There is no known exploitation of CVE-2021-33430 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-12852 Numpy missing input validation High 7.5
• CVE-2021-41496 Buffer Copy without Checking Size of Input in NumPy Medium 5.5
• CVE-2014-1858 Arbitrary file write in NumPy Medium 5.5
• CVE-2021-34141 Incorrect Comparison in NumPy Medium 5.3
• CVE-2021-41495 NumPy NULL Pointer Dereference Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLSA-2026-1789467688, CLSA-2026-1789542174, DEBIAN-CVE-2021-33430, GHSA-6p56-wp2h-9hxr, MINI-97qj-j8cw-pphg, PYSEC-2021-854 and 3 more.