PT-2021-21793 · Google · Tensorflow

Yakun Zhang · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37675

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 TensorFlow version 2.4.3 TensorFlow version 2.3.4

Description The issue is related to a division by 0 vulnerability in most implementations of convolution operators in TensorFlow, where an attacker can trigger a denial of service via a crash. The shape inference implementation is missing several validations before doing divisions and modulo operations.

Recommendations For TensorFlow versions prior to 2.6.0, update to version 2.6.0 or later. For TensorFlow version 2.5.1, apply the patch from GitHub commit 8a793b5d7f59e37ac7f3cd0954a750a2fe76bad4. For TensorFlow version 2.4.3, apply the patch from GitHub commit 8a793b5d7f59e37ac7f3cd0954a750a2fe76bad4. For TensorFlow version 2.3.4, apply the patch from GitHub commit 8a793b5d7f59e37ac7f3cd0954a750a2fe76bad4.

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-37675

CVE-2021-37675

GHSA-9C8H-2MV3-49WW

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-297

PYSEC-2021-588

PYSEC-2021-786

Affected Products

Tensorflow

References · 86

• https://github.com/tensorflow/tensorflow/commit/8a793b5d7f59e37ac7f3cd0954a750a2fe76bad4 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37675 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-588 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9c8h-2mv3-49ww · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-786 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37675 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37675 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-297 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9c8h-2mv3-49ww · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-588.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-786.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-297.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note