CVE-2021-41495 describes a Null Pointer Dereference vulnerability in the numpy.sort function within NumPy versions prior to 1.19, specifically in the PyArray_DescrNew function. This flaw, stemming from missing return-value validation, could theoretically allow an attacker to cause a Denial of Service (DoS) by repeatedly creating sort arrays. The vulnerability has a CVSS score of 5.3 (Medium), indicating a network-based attack with high attack complexity and requiring low privileges, leading to high availability impact. However, exploitation is contingent on memory exhaustion, implying the attacker would already possess significant privileges. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.19.0CPE matchmatch criteria | cpe:2.3:a:numpy:numpy:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
NumPy NULL Pointer Dereference
Feb 8, 2022Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing an error can only occur due to an exhaustion of memory. If the user can exhaust memory they are already privileged. Further it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place
Dec 14, 2021numpy: NULL pointer dereference in numpy.sort in in the PyArray_DescrNew() due to missing return-value validation
May 19, 2021