PT-2021-21803 · Google · Tensorflow

Mihaimaruseac · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37684

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description The implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. This issue has been reported by members of the Aivul Team from Qihoo 360.

Recommendations For TensorFlow versions prior to 2.6.0, update to version 2.6.0 or later. For TensorFlow versions 2.5.1 and earlier, update to version 2.5.1 or later, which includes the cherrypicked commit. For TensorFlow versions 2.4.3 and earlier, update to version 2.4.3 or later, which includes the cherrypicked commit. For TensorFlow versions 2.3.4 and earlier, update to version 2.3.4 or later, which includes the cherrypicked commit. As a temporary workaround, consider adding checks for divisors not being 0 in the pooling implementations in TFLite until a patch is available.

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-37684

CVE-2021-37684

GHSA-Q7F7-544H-67H9

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-306

PYSEC-2021-597

PYSEC-2021-795

Affected Products

Tensorflow

References · 86

• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37684 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q7f7-544h-67h9 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-795 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-306 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37684 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37684 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q7f7-544h-67h9 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-597.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-795.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-306.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note
• https://suse.com/security/cve/CVE-2021-37645 · Note