CVE-2021-37653: TensorFlow - Floating Point Exception in ResourceGather
Summary
CVE-2021-37653: Division by 0 in ResourceGather in TensorFlow. Affects tensorflow across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
>= 2.5.0, < 2.5.1
Fixed in 2.3.4, 2.4.3 or 2.5.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-37653 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow is widely used in various industries and research fields due to its flexibility and scalability. However, a vulnerability has been discovered in TensorFlow that can be exploited by an attacker to trigger a crash. This vulnerability exists in versions 2.3.0 to 2.6.0-rc2 of TensorFlow.
Vulnerability Detail
The vulnerability (CVE-2021-37653) in TensorFlow is caused by a floating point exception in the tf.raw_ops.ResourceGather function. The implementation of this function computes the value of a variable called batch_size and then divides by it without checking if the value is zero. This can lead to a floating point exception and crash the application. An attacker can exploit this vulnerability by providing a malicious input that triggers the floating point exception. The impact of this vulnerability can range from denial of service to potential remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4 -
>= 2.4.0, < 2.4.32.4.3 -
>= 2.5.0, < 2.5.12.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the patch or update TensorFlow to the latest version as soon as possible.
Conclusion
In conclusion, the vulnerability (CVE-2021-37653) in TensorFlow can be exploited by an attacker to trigger a crash via a floating point exception. This vulnerability has been patched in TensorFlow 2.6.0 and backported to earlier versions. Users are advised to update their TensorFlow installations to the latest version or apply the available patches to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem for building and deploying machine learning models.
The impact of this vulnerability can range from denial of service to potential remote code execution.
Versions 2.3.0 to 2.6.0-rc2 of TensorFlow are affected by this vulnerability.
Yes, the vulnerability has been patched in TensorFlow 2.6.0. The fix has also been backported to TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4.
No, there is no known workaround for this vulnerability. It is recommended to apply the patch or update TensorFlow to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
