CVE-2021-37642: Division by 0 in tensorflow

Background

TensorFlow is an open-source machine learning framework widely used for building and training various models. It provides a comprehensive ecosystem for developing and deploying machine learning applications. TensorFlow includes a feature called ResourceScatterDiv which is used for dividing the values of a resource variable by a specified index. However, a vulnerability has been discovered in the implementation of ResourceScatterDiv that allows a division by zero error to occur.

Vulnerability Detail

The vulnerability in ResourceScatterDiv arises from the failure to handle the division by zero case separately. This means that if the updates parameter passed to ResourceScatterDiv contains a zero value, a division by zero error will occur. An attacker could potentially exploit this vulnerability to cause a denial of service (DoS) by providing a zero value as the update. The impact of this vulnerability is considered moderate with a CVSS score of 5.5.

pip install --upgrade "tensorflow==2.21.0"

Workaround

As a workaround, users can ensure that the updates parameter passed to ResourceScatterDiv does not contain a zero value. This can be achieved by validating the input values before calling the function. Here is an example of how to check for zero values in Python:

import tensorflow as tf

v = tf.Variable([1, 2, 3])
updates = [0]

if all(update != 0 for update in updates):
    tf.raw_ops.ResourceScatterDiv(
        resource=v.handle,
        indices=[1],
        updates=updates
    )

Conclusion

In conclusion, the vulnerability in TensorFlow's ResourceScatterDiv function allows a division by zero error to occur. This vulnerability has been addressed in TensorFlow versions 2.3.4, 2.4.3, 2.5.1, and 2.6.0. Users are advised to update their TensorFlow installation to one of the patched versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ