CVE-2021-29525: TensorFlow Division by Zero Vulnerability

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. It offers support for both CPU and GPU computations, enabling efficient training and inference on large-scale datasets. However, a vulnerability has been discovered in TensorFlow that can lead to a division by zero error in the tf.raw_ops.Conv2DBackpropInput function.

Vulnerability Detail

The vulnerability arises due to a division operation in the implementation of tf.raw_ops.Conv2DBackpropInput. The division is performed using a value controlled by the caller, allowing an attacker to trigger a division by zero. This can result in a crash or unexpected behavior of the TensorFlow application. The vulnerability has been assigned the CVE identifier CVE-2021-29525. It was reported on May 14, 2021, and the fix will be included in TensorFlow 2.5.0. The affected versions include TensorFlow 2.1.4, 2.2.3, 2.3.3, and 2.4.2.

pip install --upgrade "tensorflow==2.21.0"

Workaround

As a temporary workaround, users can validate the input values before calling the tf.raw_ops.Conv2DBackpropInput function to avoid passing a value that could result in a division by zero. This can be done by checking the input values and ensuring they are within acceptable ranges. Here is an example of how to perform the validation in Python:

def conv2d_backprop_input_with_validation(input, filter, out_backprop, strides, padding):
    if input == 0 or filter == 0:
        raise ValueError('Input and filter must be non-zero')
    return tf.raw_ops.Conv2DBackpropInput(input, filter, out_backprop, strides, padding)

Conclusion

In conclusion, a division by zero vulnerability has been discovered in TensorFlow, which can be triggered in the tf.raw_ops.Conv2DBackpropInput function. This vulnerability can lead to a crash or unexpected behavior of TensorFlow applications. It is crucial to update to the fixed versions of TensorFlow and regularly update dependencies to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ