CVE-2021-29526: Division by 0 in TensorFlow Conv2D

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

TensorFlow is an open-source machine learning framework widely used for developing and training deep learning models. It provides a comprehensive set of tools and libraries for building and deploying machine learning applications. The Conv2D function in TensorFlow is used for performing 2D convolution operations on input tensors. This vulnerability affects versions 0.0.0 to 2.1.4 of the TensorFlow package.

Vulnerability Detail

The vulnerability (CVE-2021-29526) arises from a division by zero issue in the Conv2D function of TensorFlow. An attacker can exploit this vulnerability by providing specific input and filter tensors that result in a division by zero during the convolution operation. This can lead to a crash or unexpected behavior in the application using TensorFlow. The vulnerability has a CVSS score of 2.5, indicating a low severity level.

pip install --upgrade "tensorflow==2.21.0"

Workaround

If updating TensorFlow is not immediately possible, a workaround can be implemented by validating the input and filter tensors before passing them to the Conv2D function. This can involve checking the dimensions and ensuring that the division operation will not result in a division by zero. Here is an example of a workaround in Python:

import tensorflow as tf

input = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)
filter = tf.constant([], shape=[0, 0, 0, 0], dtype=tf.float32)

strides = [1, 1, 1, 1]
padding = "SAME"

if input.shape[3] % filter.shape[2] != 0:
    # Handle the division by zero case
    print("Invalid input and filter dimensions")
else:
    tf.raw_ops.Conv2D(input=input, filter=filter, strides=strides, padding=padding)

Conclusion

In conclusion, the vulnerability (CVE-2021-29526) in TensorFlow's Conv2D function can be exploited to trigger a division by zero, leading to a crash or unexpected behavior. It is recommended to update the TensorFlow package to one of the patched versions or implement the provided workaround. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ