CVE-2021-29550: TensorFlow - Division by Zero Denial of Service

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. It offers support for both CPU and GPU computations, making it suitable for a wide range of hardware configurations. However, a vulnerability has been discovered in TensorFlow that can lead to a denial of service (DoS) attack.

Vulnerability Detail

The vulnerability (CVE-2021-29550) in TensorFlow exists in the tf.raw_ops.FractionalAvgPool function. An attacker can exploit this vulnerability by providing user-controlled values for input_size[i] and pooling_ratio_[i] parameters. If the value of input_size[i] is smaller than pooling_ratio_[i], the floor operation results in output_size[i] being 0. This leads to a division by zero error and a runtime crash. The issue arises due to the improper handling of user-controlled values in the computation of divisor quantity. In released versions of TensorFlow, the DCHECK_GT line, which could detect this issue, is a no-op outside of debug mode.

pip install --upgrade "tensorflow==2.21.0"

Workaround

As a temporary workaround, users can manually validate the values of input_size[i] and pooling_ratio_[i] before passing them to the tf.raw_ops.FractionalAvgPool function. By ensuring that input_size[i] is greater than or equal to pooling_ratio_[i], the division by zero error can be avoided. Here is an example code snippet that demonstrates the workaround:

import tensorflow as tf

input_size = ...
pooling_ratio_ = ...

if input_size >= pooling_ratio_:
    output = tf.raw_ops.FractionalAvgPool(value, pooling_ratio_)
else:
    # Handle the case where input_size is smaller than pooling_ratio_
    ...

Conclusion

In conclusion, the vulnerability (CVE-2021-29550) in TensorFlow can be exploited by an attacker to cause a denial of service (DoS) by triggering a runtime division by zero error. The issue arises due to the improper handling of user-controlled values in the computation of divisor quantity. To mitigate this vulnerability, users should update their TensorFlow installations to the latest patched version once it becomes available. In the meantime, a temporary workaround is available by manually validating the input values. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ