CVE-2021-29599: TensorFlow - Division by Zero Vulnerability

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. The vulnerability discussed here affects the TensorFlow package, specifically the Split TFLite operator.

Vulnerability Detail

The implementation of the Split TFLite operator in TensorFlow is vulnerable to a division by zero error. This vulnerability can be exploited by an attacker who crafts a malicious model in such a way that the num_splits parameter is set to 0. When this model is executed, a division by zero error occurs, leading to a potential crash or undefined behavior. The vulnerability has been identified in the source code of TensorFlow and has been assigned the identifier CVE-2021-29599. It was reported on May 14, 2021, and the fix will be included in TensorFlow 2.5.0. To address this issue, the TensorFlow team will also backport the fix to earlier versions, including TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, and TensorFlow 2.1.4.

pip install --upgrade "tensorflow==2.21.0"

Workaround

As a temporary workaround, users can manually modify the affected code in the TensorFlow package to handle the division by zero scenario. One possible approach is to add a check for the num_splits parameter and ensure it is not zero before performing the division operation. Here is an example of how the code can be modified:

// Original code
if (num_splits > 0) {
  // Perform division
}

// Modified code
if (num_splits > 0) {
  // Perform division
} else {
  // Handle division by zero error
}

Conclusion

The division by zero vulnerability in the Split TFLite operator of TensorFlow can be exploited by an attacker to cause a crash or undefined behavior. To mitigate this risk, it is crucial to update TensorFlow to the latest version or apply the recommended fixes for the affected versions. For further assistance and support in addressing this vulnerability, please contact DevNack.com.

See every vulnerability recorded for tensorflow →

FAQ