PT-2021-18289 · Google · Tensorflow

Yakun Zhang + 1 · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29538

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description: An attacker can cause a division by zero to occur in Conv2DBackpropFilter. This is because the implementation computes a divisor based on user-provided data, specifically the shape of the tensors given as arguments. If all shapes are empty, then work unit size is 0, and since there is no check for this case before division, this results in a runtime exception, with potential to be abused for a denial of service.

Recommendations: For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later. For TensorFlow version 2.4.2, update to version 2.4.2 or later. For TensorFlow version 2.3.3, update to version 2.3.3 or later. For TensorFlow version 2.2.3, update to version 2.2.3 or later. For TensorFlow version 2.1.4, update to version 2.1.4 or later. As a temporary workaround, consider avoiding the use of Conv2DBackpropFilter with empty shapes until a patch is available.

Exploit

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-29538

CVE-2021-29538

GHSA-J8QC-5FQR-52FP

PYSEC-2021-175

PYSEC-2021-466

PYSEC-2021-664

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j8qc-5fqr-52fp · Exploit
• https://github.com/tensorflow/tensorflow/commit/c570e2ecfc822941335ad48f6e10df4e21f11c96 · Patch
• https://osv.dev/vulnerability/GHSA-j8qc-5fqr-52fp · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29538 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-466 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-175 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29538 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29538 · Security Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-175.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-466.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-664.yaml · Note