PT-2021-18268 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29517

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4

Description: A malicious user could trigger a division by 0 in the Conv3D implementation. The implementation does a modulo operation based on user-controlled input, and when the filter has a 0 as the fifth element, this results in a division by 0. Additionally, if the shape of the two tensors is not valid, an Eigen assertion can be triggered, resulting in a program crash.

Recommendations: For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later. For TensorFlow version 2.4.2, apply the cherrypicked commit. For TensorFlow version 2.3.3, apply the cherrypicked commit. For TensorFlow version 2.2.3, apply the cherrypicked commit. For TensorFlow version 2.1.4, apply the cherrypicked commit. As a temporary workaround, consider disabling the Conv3D function until a patch is available. Avoid using the filter tensor with a 0 as the fifth element in the affected Conv3D implementation until the issue is resolved.

Exploit

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-29517

CVE-2021-29517

GHSA-772P-X54P-HJRV

PYSEC-2021-154

PYSEC-2021-445

PYSEC-2021-643

Affected Products

Tensorflow

References · 12

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-772p-x54p-hjrv · Exploit
• https://github.com/tensorflow/tensorflow/commit/799f835a3dfa00a4d852defa29b15841eea9d64f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-29517 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29517 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-643 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-772p-x54p-hjrv · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-445 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29517 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-154 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-643.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-445.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-154.yaml · Note