CVE-2021-29595: TensorFlow GPU - Division by Zero Error in DepthToSpace TFLite Operator

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow GPU is a variant of TensorFlow that leverages the power of GPUs for accelerated computation. The DepthToSpace TFLite operator is responsible for rearranging data in a tensor from depth into blocks of spatial data. This operator is used in various machine learning models and applications.

Vulnerability Detail

The implementation of the DepthToSpace TFLite operator in TensorFlow GPU is vulnerable to a division by zero error. The vulnerability exists in the code responsible for calculating the block size parameter (params->block_size). An attacker can craft a malicious model in such a way that the block size is set to zero, triggering a division by zero error during execution. This vulnerability can lead to a crash or unexpected behavior of the TensorFlow GPU runtime. The issue has been identified and fixed in TensorFlow 2.5.0. To mitigate the risk, it is recommended to update to the latest version of TensorFlow GPU.

pip install --upgrade "tensorflow-gpu==2.12.0"

Workaround

As a temporary workaround, users can manually modify the affected code in the TensorFlow GPU source files to handle the division by zero error. One possible approach is to add a check for a zero block size before performing the division operation. Here is an example of how the code can be modified:

// Original code
if (params->block_size == 0) {
  // Division by zero error
}

// Modified code
if (params->block_size == 0) {
  // Handle the division by zero error
} else {
  // Perform the division operation
}

Conclusion

The division by zero error in the DepthToSpace TFLite operator of TensorFlow GPU can be exploited by an attacker to cause a crash or unexpected behavior of the TensorFlow GPU runtime. To mitigate this vulnerability, it is recommended to update TensorFlow GPU to version 2.5.0 or later. Alternatively, a temporary workaround can be applied by modifying the affected code to handle the division by zero error. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-gpu →

FAQ