CVE-2021-29573: TensorFlow - Division by 0 in MaxPoolGradWithArgmax
Summary
CVE-2021-29573: Division by 0 in MaxPoolGradWithArgmax. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29573 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive set of tools, libraries, and resources for building and deploying machine learning models. TensorFlow includes various operations and functions to perform tasks such as data preprocessing, model training, and inference. One of the operations, tf.raw_ops.MaxPoolGradWithArgmax, is responsible for computing the gradients of the max pooling operation with argmax indices. This operation is vulnerable to a division by 0.
Vulnerability Detail
The vulnerability in TensorFlow's tf.raw_ops.MaxPoolGradWithArgmax arises from a lack of validation for the batch dimension of the tensor before performing a division operation. The implementation fails to check if the batch dimension is non-zero, leading to a potential division by 0 error. An attacker could exploit this vulnerability by providing a tensor with a batch dimension of 0, causing the division operation to fail. This vulnerability could result in a denial of service (DoS) condition, impacting the availability of the TensorFlow application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the provided fix by upgrading to the patched versions of TensorFlow.
Conclusion
The vulnerability in TensorFlow's tf.raw_ops.MaxPoolGradWithArgmax could result in a division by 0 error, leading to a denial of service (DoS) condition. Users of affected versions should upgrade to the patched versions of TensorFlow to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for building and deploying machine learning models.
tf.raw_ops.MaxPoolGradWithArgmax is an operation in TensorFlow that computes the gradients of the max pooling operation with argmax indices.
This vulnerability could lead to a denial of service (DoS) condition in TensorFlow applications, impacting their availability.
To fix this vulnerability, it is recommended to upgrade to TensorFlow 2.5.0 or later. Alternatively, you can update to one of the backported fixes in TensorFlow versions 2.4.2, 2.3.3, 2.2.3, or 2.1.4.
No, there is no known workaround for this vulnerability. It is recommended to apply the provided fix by upgrading TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
