CVE-2021-29586: TensorFlow Pooling Implementation Division by Zero

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow allows users to build and train neural networks, perform data preprocessing and augmentation, and deploy models on various platforms. It is widely used in both research and production environments.

Vulnerability Detail

The vulnerability (CVE-2021-29586) exists in the optimized pooling implementations in TFLite, a TensorFlow library for running machine learning models on mobile and embedded devices. The issue arises due to a failure to check the stride arguments before calling the ComputePaddingHeightWidth function. This allows users to create models with zero stride values, resulting in a division by zero error. An attacker can exploit this vulnerability by crafting a malicious model, leading to a denial of service (DoS) condition or potential code execution.

pip install --upgrade "tensorflow-cpu==2.21.0"

Workaround

As a workaround, users can manually check and ensure that the stride arguments in their models are not set to zero. This can be done by validating the input parameters and adjusting the stride values if necessary. Here is an example code snippet that demonstrates the workaround:

import tensorflow as tf

# Check and adjust stride values
if stride_height == 0:
    stride_height = 1
if stride_width == 0:
    stride_width = 1

# Continue with pooling operation
# ...

Conclusion

The vulnerability (CVE-2021-29586) in TensorFlow's optimized pooling implementations can be exploited by crafting malicious models with zero stride values, resulting in a division by zero error. This can lead to a denial of service condition or potential code execution. It is recommended to update TensorFlow to the latest patched version (2.5.0 or above) or manually check and adjust the stride arguments in models to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ