PT-2021-18345 · Google · Tensorflow

Mihaimaruseac · Published 2021-05-14 · Updated 2024-03-06 · CVE-2021-29594

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.5.0 TensorFlow versions 2.4.2 and earlier TensorFlow versions 2.3.3 and earlier TensorFlow versions 2.2.3 and earlier TensorFlow versions 2.1.4 and earlier

Description The issue arises from the convolution code in TFLite, where multiple divisions occur with a divisor controlled by the user and not checked to be non-zero. For example, in the code const int input size = NumElements(input) / SizeOfDimension(input, 0);, the divisor is not verified to be non-zero. This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Recommendations For versions prior to 2.5.0, update to TensorFlow 2.5.0 or later. For versions 2.4.2 and earlier, update to TensorFlow 2.4.2 or later. For versions 2.3.3 and earlier, update to TensorFlow 2.3.3 or later. For versions 2.2.3 and earlier, update to TensorFlow 2.2.3 or later. For versions 2.1.4 and earlier, update to TensorFlow 2.1.4 or later.

Exploit

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-29594

CVE-2021-29594

GHSA-3QGW-P4FM-X7GF

PYSEC-2021-231

PYSEC-2021-522

PYSEC-2021-720

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3qgw-p4fm-x7gf · Exploit
• https://github.com/tensorflow/tensorflow/commit/ff489d95a9006be080ad14feb378f2b4dac35552 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-29594 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-231 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3qgw-p4fm-x7gf · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-720 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-29594 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-29594 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-522 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/09c73bca7d648e961dd05898292d91a8322a9d45/tensorflow/lite/kernels/conv.cc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-720.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-231.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-522.yaml · Note