CVE-2021-37636: Floating point exception in TensorFlow

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

TensorFlow is an open-source machine learning framework that provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. It is widely used in various domains, including research, industry, and academia. TensorFlow allows users to build and train neural networks, perform numerical computations, and process large datasets efficiently. However, a vulnerability has been identified in TensorFlow that can lead to a floating point exception.

Vulnerability Detail

The vulnerability, identified as CVE-2021-37636, exists in the implementation of tf.raw_ops.SparseDenseCwiseDiv in TensorFlow. This function is used for element-wise division between a sparse tensor and a dense tensor. The implementation fails to handle the division by zero case, resulting in a floating point exception. An attacker could exploit this vulnerability by providing malicious input data, leading to a division by zero error and potentially causing the application to crash or behave unexpectedly. The impact of this vulnerability is considered moderate, with a CVSS score of 5.5.

pip install --upgrade "tensorflow==2.21.0"

Workaround

As a workaround, users can validate the input data before invoking the tf.raw_ops.SparseDenseCwiseDiv function to ensure that no division by zero occurs. This can be done by checking the values of the input tensors and ensuring that the divisor is not zero. Here is an example of how to perform the validation in Python:

import tensorflow as tf
import numpy as np

sp_indices = np.array([[4]])
sp_values = np.array([-400])
sp_shape = np.array([647.])
dense = np.array([0])

if np.any(dense == 0):
    raise ValueError('Division by zero is not allowed.')

# Proceed with the division operation
result = tf.raw_ops.SparseDenseCwiseDiv(sp_indices, sp_values, sp_shape, dense)

By performing this validation, the risk of encountering a division by zero error can be mitigated.

Conclusion

In conclusion, the vulnerability identified as CVE-2021-37636 in TensorFlow can lead to a floating point exception when performing element-wise division between a sparse tensor and a dense tensor. The TensorFlow team has released patches to address this vulnerability, and users are advised to update their installations to the latest patched version. A workaround is also available by validating the input data to prevent division by zero. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ