CVE-2021-29595: TensorFlow-CPU DepthToSpace Operator Division by Zero Vulnerability

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow-CPU is a specific package that focuses on providing CPU support for TensorFlow. It allows users to run TensorFlow models on CPUs without the need for GPU acceleration. The DepthToSpace operator in TensorFlow-CPU is responsible for rearranging data in a tensor, and it is used in various machine learning tasks such as image processing and computer vision.

Vulnerability Detail

The DepthToSpace operator in TensorFlow-CPU is vulnerable to a division by zero error. This vulnerability occurs due to a lack of proper input validation, specifically when the params->block_size parameter is set to 0. An attacker can exploit this vulnerability by crafting a malicious model that triggers the division by zero error. The consequences of this vulnerability can range from program crashes to potential code execution, depending on how the error is handled by the application. This vulnerability affects multiple versions of TensorFlow-CPU, including 2.1.4, 2.2.3, 2.3.3, and 2.4.2.

pip install --upgrade "tensorflow-cpu==2.21.0"

Workaround

As a temporary workaround, users can manually validate the params->block_size parameter before passing it to the DepthToSpace operator. By ensuring that the block size is not set to 0, the division by zero error can be avoided. Here is an example code snippet that demonstrates the workaround:

block_size = get_block_size()
if block_size != 0:
    depth_to_space(block_size)

Conclusion

The TensorFlow-CPU DepthToSpace operator division by zero vulnerability poses a risk to applications utilizing TensorFlow-CPU for machine learning tasks. It is crucial for users to update their TensorFlow-CPU installations to the patched versions provided by the TensorFlow team. Following the recommended fix and applying the workaround, if necessary, will help mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-cpu →

FAQ