PT-2021-23191 · Google · Tensorflow

Published 2021-11-05 · Updated 2024-03-06 · CVE-2021-41218

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.7.0 TensorFlow versions 2.6.1 and earlier TensorFlow versions 2.5.2 and earlier TensorFlow versions 2.4.4 and earlier

Description TensorFlow is an open source platform for machine learning. In affected versions, the shape inference code for AllToAll can be made to execute a division by 0. This occurs whenever the split count argument is 0.

Recommendations For versions prior to 2.7.0, update to TensorFlow 2.7.0 or later. For versions 2.6.1 and earlier, update to TensorFlow 2.6.1 or later. For versions 2.5.2 and earlier, update to TensorFlow 2.5.2 or later. For versions 2.4.4 and earlier, update to TensorFlow 2.4.4 or later. As a temporary workaround, consider avoiding the use of the split count argument with a value of 0 in the AllToAll function until a patch is available.

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

BIT-TENSORFLOW-2021-41218

CVE-2021-41218

GHSA-9CRF-C6QR-R273

OPENSUSE-SU-2024:12116-1

PYSEC-2021-410

PYSEC-2021-627

PYSEC-2021-825

Affected Products

Tensorflow

References · 16

• https://github.com/tensorflow/tensorflow/commit/a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41218 · Security Note
• https://osv.dev/vulnerability/GHSA-9crf-c6qr-r273 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-825 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-410 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2021-41218 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41218 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-627 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9crf-c6qr-r273 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-825.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-410.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-627.yaml · Note
• https://t.me/cibsecurity/31932 · Telegram Post
• https://t.me/cvenotify/23115 · Telegram Post