PT-2021-21802 · Google · Tensorflow

Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37683

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow version 2.5.1 TensorFlow version 2.4.3 TensorFlow version 2.3.4

Description The implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements.

Recommendations For TensorFlow versions prior to 2.6.0, update to version 2.6.0 or later. For TensorFlow version 2.5.1, apply the patch from GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. For TensorFlow version 2.4.3, apply the patch from GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. For TensorFlow version 2.3.4, apply the patch from GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28.

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-37683

CVE-2021-37683

GHSA-RHRQ-64MQ-HF9H

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-305

PYSEC-2021-596

PYSEC-2021-794

Affected Products

Tensorflow

References · 87

• https://github.com/tensorflow/tensorflow/commit/1e206baedf8bef0334cca3eb92bab134ef525a28 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37683 · Security Note
• https://osv.dev/vulnerability/GHSA-rhrq-64mq-hf9h · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-305 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37683 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-596 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37683 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-794 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rhrq-64mq-hf9h · Note
• https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/div.cc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-596.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-794.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-305.yaml · Note