CVE-2021-37691: TensorFlow - Division by Zero Error in LSH Projection
Summary
CVE-2021-37691: Division by zero in LSH in TensorFlow Lite. Affects tensorflow across 3 version ranges.
>= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
>= 2.5.0, < 2.5.1
Fixed in 2.3.4, 2.4.3 or 2.5.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2021-37691 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive set of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, academia, and industry. This vulnerability affects versions 2.3.0 to 2.6.0-rc2 of TensorFlow.
Vulnerability Detail
The vulnerability in TensorFlow allows an attacker to create a TFLite model that triggers a division by zero error in the LSH projection implementation. This can lead to unexpected behavior or crashes in applications that use TensorFlow for machine learning tasks. The issue has been patched in the GitHub commit 0575b640091680cfb70f4dd93e70658de43b94f9 and will be included in TensorFlow 2.6.0. The fix will also be backported to TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.3.0, < 2.3.42.3.4 -
>= 2.4.0, < 2.4.32.4.3 -
>= 2.5.0, < 2.5.12.5.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the patched version of TensorFlow as soon as possible.
Conclusion
The division by zero error vulnerability in TensorFlow can be mitigated by updating to the latest patched version or applying the relevant commit manually. It is important to keep TensorFlow installations up to date to ensure the security and stability of machine learning applications. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for building and deploying machine learning models.
This vulnerability can lead to unexpected behavior or crashes in applications that use TensorFlow for machine learning tasks.
Versions 2.3.0 to 2.6.0-rc2 of TensorFlow are affected by this vulnerability.
To fix this vulnerability, update to the latest patched version of TensorFlow or manually apply the patch by cherry-picking the relevant commit from the GitHub repository.
There is no known workaround for this vulnerability. It is recommended to update to the patched version of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
