PT-2021-18340 · Google · Tensorflow

Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29589

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow version 2.4.2 TensorFlow version 2.3.3 TensorFlow version 2.2.3 TensorFlow version 2.1.4

Description The reference implementation of the GatherNd TFLite operator is vulnerable to a division by zero error. An attacker can craft a model such that params input would be an empty tensor, causing params shape.Dims(.) to be zero in at least one dimension.

Recommendations For TensorFlow versions prior to 2.5.0, update to version 2.5.0 or later. For TensorFlow version 2.4.2, update to a patched version that includes the fix. For TensorFlow version 2.3.3, update to a patched version that includes the fix. For TensorFlow version 2.2.3, update to a patched version that includes the fix. For TensorFlow version 2.1.4, update to a patched version that includes the fix. As a temporary workaround, consider restricting the use of the GatherNd TFLite operator until a patch is available.

Exploit

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-29589

CVE-2021-29589

GHSA-3W67-Q784-6W7C

PYSEC-2021-226

PYSEC-2021-517

PYSEC-2021-715

Affected Products

Tensorflow

References · 15

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3w67-q784-6w7c · Exploit
• https://github.com/tensorflow/tensorflow/commit/8e45822aa0b9f5df4b4c64f221e64dc930a70a9d · Patch
• https://osv.dev/vulnerability/GHSA-3w67-q784-6w7c · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-517 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29589 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-715 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-226 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29589 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29589 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/internal/reference/reference_ops.h#L966 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-226.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-517.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-715.yaml · Note
• https://t.me/cvenotify/14667 · Telegram Post