PT-2021-21777 · Google · Tensorflow
Published
2021-08-12
·
Updated
2024-03-06
·
CVE-2021-37660
CVSS v4.0
6.8
Medium
| Vector | AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
TensorFlow versions prior to 2.6.0
TensorFlow versions 2.5.1 and earlier
TensorFlow versions 2.4.3 and earlier
TensorFlow versions 2.3.4 and earlier
Description
An attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The implementation has a logic error: it should skip processing if
x and v are empty but the code uses || instead of &&. This issue can be exploited by calling tf.raw ops.InplaceSub with specific arguments, such as x=[] and v=[1,1,1].Recommendations
For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later.
For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later, or apply the patch from GitHub commit e86605c0a336c088b638da02135ea6f9f6753618.
For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later, or apply the patch from GitHub commit e86605c0a336c088b638da02135ea6f9f6753618.
For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later, or apply the patch from GitHub commit e86605c0a336c088b638da02135ea6f9f6753618.
As a temporary workaround, consider avoiding the use of
tf.raw ops.InplaceSub with crafted arguments until a patch is available.Fix
Divide By Zero
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tensorflow