CVE-2021-29538

Name
CVE-2021-29538
Description
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a division by zero to occur in `Conv2DBackpropFilter`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/1b0296c3b8dd9bd948f924aa8cd62f87dbb7c3da/tensorflow/core/kernels/conv_grad_filter_ops.cc#L513-L522) computes a divisor based on user provided data (i.e., the shape of the tensors given as arguments). If all shapes are empty then `work_unit_size` is 0. Since there is no check for this case before division, this results in a runtime exception, with potential to be abused for a denial of service. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
NVD Severity
medium
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MISC https://github.com/tensorflow/tensorflow/commit/c570e2ecfc822941335ad48f6e10df4e21f11c96
CONFIRM https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j8qc-5fqr-52fp

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:* tensorflow >= None <= 2.1.4:
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:* tensorflow >= 2.2.0: <= 2.2.3:
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:* tensorflow >= 2.3.0: <= 2.3.3:
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:* tensorflow >= 2.4.0: <= 2.4.2:
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:* tensorflow >= None <= 2.1.4
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:* tensorflow >= 2.2.0 <= 2.2.3
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:* tensorflow >= 2.3.0 <= 2.3.3
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:* tensorflow >= 2.4.0 <= 2.4.2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status