PT-2021-21811 · Google · Tensorflow

Yakun Zhang · Published 2021-08-12 · Updated 2024-03-06 · CVE-2021-37691

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.0 TensorFlow versions 2.5.1 and earlier TensorFlow versions 2.4.3 and earlier TensorFlow versions 2.3.4 and earlier

Description An attacker can craft a TFLite model that would trigger a division by zero error in LSH implementation. The issue arises from the lack of a check that the first dimension of the input is non-zero in the RunningSignBit function.

Recommendations For versions prior to 2.6.0, update to TensorFlow 2.6.0 or later. For versions 2.5.1 and earlier, update to TensorFlow 2.5.1 or later. For versions 2.4.3 and earlier, update to TensorFlow 2.4.3 or later. For versions 2.3.4 and earlier, update to TensorFlow 2.3.4 or later.

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-37691

CVE-2021-37691

GHSA-27QF-JWM8-G7F3

OPENSUSE-SU-2022:10014-1

OPENSUSE-SU-2024:12116-1

PYSEC-2021-313

PYSEC-2021-604

PYSEC-2021-802

Affected Products

Tensorflow

References · 87

• https://github.com/tensorflow/tensorflow/commit/0575b640091680cfb70f4dd93e70658de43b94f9 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2022:10014-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37691 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-604 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37691 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-802 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-37691 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-27qf-jwm8-g7f3 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-313 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-27qf-jwm8-g7f3 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-604.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-802.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-313.yaml · Note
• https://suse.com/security/cve/CVE-2021-37656 · Note