PT-2021-23179 · Google · Tensorflow

Published

2021-11-05

·

Updated

2024-03-06

·

CVE-2021-41207

CVSS v4.0

6.8

Medium

VectorAV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier
Description The implementation of ParallelConcat in TensorFlow misses some input validation and can produce a division by 0. This issue affects the tf.raw ops.ParallelConcat function, which can be exploited by passing invalid input, such as a shape of 0. The issue is demonstrated by the following code:
import tensorflow as tf

@tf.function
def test():
 y = tf.raw ops.ParallelConcat(values=[['tf']], shape=0)
 return y

test()
The estimated number of potentially affected devices worldwide is not available.
Recommendations For versions prior to 2.7.0, update to TensorFlow 2.7.0 or later. For versions 2.6.1 and earlier, update to TensorFlow 2.6.1 or later. For versions 2.5.2 and earlier, update to TensorFlow 2.5.2 or later. For versions 2.4.4 and earlier, update to TensorFlow 2.4.4 or later. As a temporary workaround, consider avoiding the use of the ParallelConcat function until a patch is available.

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-41207
CVE-2021-41207
GHSA-7V94-64HJ-M82H
OPENSUSE-SU-2024:12116-1
PYSEC-2021-399
PYSEC-2021-616
PYSEC-2021-814

Affected Products

Tensorflow