CVE-2021-29589: TensorFlow-CPU - Division by Zero Vulnerability

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow-CPU is a specific package that focuses on running TensorFlow on CPUs. It is widely used in various industries for machine learning tasks.

Vulnerability Detail

The reference implementation of the GatherNd TFLite operator in TensorFlow-CPU is vulnerable to a division by zero error. This vulnerability can be exploited by an attacker by crafting a model with an empty tensor as the params input. When params_shape.Dims(.) is zero in at least one dimension, a division by zero occurs. This vulnerability can lead to a crash or unexpected behavior of the TensorFlow-CPU application. The issue has been identified and a fix will be included in TensorFlow 2.5.0. Additionally, the fix will be backported to TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3, and TensorFlow 2.1.4, as these versions are also affected and still within the supported range.

pip install --upgrade "tensorflow-cpu==2.21.0"

Workaround

As a temporary workaround, users can check if their input tensor is empty before passing it to the GatherNd TFLite operator. By ensuring that the params input is not empty, the division by zero error can be avoided. Here is an example code snippet demonstrating the workaround:

import tensorflow as tf

params = tf.constant([])  # Check if params is empty
if tf.size(params) > 0:
    # Perform the TFLite operation
    result = tf.raw_ops.GatherNd(params)
else:
    # Handle the empty case
    result = tf.constant([])

Conclusion

The division by zero vulnerability in TensorFlow-CPU's GatherNd TFLite operator can be mitigated by updating to the patched versions or by applying the temporary workaround. It is crucial for users to promptly update their TensorFlow-CPU installations to ensure the security and stability of their machine learning applications. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ