PT-2021-21757 · Google · Tensorflow

Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37642

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description The implementation of tf.raw ops.ResourceScatterDiv is vulnerable to a division by 0 error. This occurs because the implementation uses a common class for all binary operations but fails to treat the division by 0 case separately. The issue can be exploited using the tf.raw ops.ResourceScatterDiv function with specific parameters, such as resource=v.handle, indices=[1], and updates=[0].

Recommendations For TensorFlow versions prior to 2.6.0, update to version 2.6.0 or later. For TensorFlow versions 2.5.1 and earlier, update to version 2.5.1 or later, or apply the patch from GitHub commit 4aacb30888638da75023e6601149415b39763d76. For TensorFlow versions 2.4.3 and earlier, update to version 2.4.3 or later, or apply the patch from GitHub commit 4aacb30888638da75023e6601149415b39763d76. For TensorFlow versions 2.3.4 and earlier, update to version 2.3.4 or later, or apply the patch from GitHub commit 4aacb30888638da75023e6601149415b39763d76. As a temporary workaround, consider avoiding the use of the tf.raw ops.ResourceScatterDiv function with division by 0 until a patch is applied.

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-37642

CVE-2021-37642

GHSA-CH4F-829C-V5PW

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-264

PYSEC-2021-555

PYSEC-2021-753

Affected Products

Tensorflow

References · 86

• https://github.com/tensorflow/tensorflow/commit/4aacb30888638da75023e6601149415b39763d76 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37642 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37642 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ch4f-829c-v5pw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37642 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-753 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-264 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-555 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-ch4f-829c-v5pw · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-555.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-264.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-753.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note