CVE-2021-37653: TensorFlow GPU - Floating Point Exception in ResourceGather

Background

TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow GPU is a variant of TensorFlow that leverages GPU acceleration for faster computation. It is widely used in various industries and research domains for deep learning tasks.

Vulnerability Detail

The vulnerability (CVE-2021-37653) in TensorFlow GPU arises from a flaw in the tf.raw_ops.ResourceGather function. By exploiting this vulnerability, an attacker can trigger a crash by causing a floating point exception. The issue stems from the implementation of the function, specifically in the computation of the value batch_size. The code divides by batch_size without checking if the value is zero, leading to a potential division by zero error. This vulnerability can be exploited to disrupt the execution of TensorFlow GPU applications, potentially causing denial of service or other unexpected behavior.

pip install --upgrade "tensorflow-gpu==2.12.0"

Workaround

As a workaround, users can manually modify the affected code in the tf.raw_ops.ResourceGather function to include a check for a zero value of batch_size before performing the division operation. Here is an example of the modified code:

# Original code
batch_size = compute_batch_size()
result = value / batch_size

# Modified code
batch_size = compute_batch_size()
if batch_size != 0:
    result = value / batch_size
else:
    # Handle the zero value case
    result = 0

Conclusion

The vulnerability (CVE-2021-37653) in TensorFlow GPU can be exploited to trigger a crash via a floating point exception in the tf.raw_ops.ResourceGather function. It is crucial to upgrade to the latest patched version of TensorFlow GPU (2.6.0) or apply the provided workaround to mitigate the risk associated with this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for tensorflow-gpu →

FAQ