CVE-2021-29594: TensorFlow - Division by Zero Vulnerability
Summary
CVE-2021-29594: Division by zero in TFLite's convolution code. Affects tensorflow across 4 version ranges.
< 2.1.4
>= 2.2.0, < 2.2.3
>= 2.3.0, < 2.3.3
>= 2.4.0, < 2.4.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-29594 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for developing and deploying machine learning models. TensorFlow Lite (TFLite) is a lightweight version of TensorFlow designed for mobile and embedded devices. TFLite's convolution code is responsible for performing convolution operations in machine learning models.
Vulnerability Detail
The TFLite's convolution code in TensorFlow has a vulnerability that allows a user-controlled divisor to be zero. This vulnerability arises due to the lack of proper validation checks on the divisor. An attacker could exploit this vulnerability by providing a zero divisor, leading to a division by zero error. This error can result in unexpected program behavior, crashes, or even potential security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.1.42.1.4 -
>= 2.2.0, < 2.2.32.2.3 -
>= 2.3.0, < 2.3.32.3.3 -
>= 2.4.0, < 2.4.22.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to upgrade to the fixed versions of TensorFlow.
Conclusion
The division by zero vulnerability in TensorFlow's TFLite convolution code can have serious consequences if exploited. It is crucial to upgrade to the fixed versions of TensorFlow to ensure the proper validation of the divisor and prevent potential security breaches. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem for developing and deploying machine learning models.
TensorFlow Lite (TFLite) is a lightweight version of TensorFlow designed for mobile and embedded devices.
This vulnerability can lead to unexpected program behavior, crashes, or potential security breaches if exploited by an attacker.
The vulnerability affects TensorFlow versions 2.1.4 and later, including TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, and TensorFlow 2.1.4.
To fix this vulnerability, it is recommended to upgrade to TensorFlow 2.5.0 or later. Alternatively, you can also upgrade to the backported fixes available for TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, and TensorFlow 2.1.4.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
