CVE-2021-29517lowCWE-369

CVE-2021-29517: low-severity vulnerability in tensorflow

Division by zero in `Conv3D`

Published · Updated

Follow this CVE+ Monitor tensorflow+ Monitor tensorflow

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.5epss 0.2%
TensorFlow is an end-to-end open source platform for machine learning. A malicious user could trigger a division by 0 in `Conv3D` implementation. The implementation(https://github.com/tensorflow/tensorflow/blob/42033603003965bffac51ae171b51801565e002d/tensorflow/core/kernels/conv_ops_3d.cc#L143-L145) does a modulo operation based on user controlled input. Thus, when `filter` has a 0 as the fifth element, this results in a division by 0. Additionally, if the shape of the two tensors is not valid, an Eigen assertion can be triggered, resulting in a program crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected products
tensorflow · tensorflow
Related CVEs — tensorflow

In the same product, most dangerous first.

CVE-2020-15202CRITICALInteger truncation in Shard API usageEPSS 1.3%CVE-2020-15207HIGHSegfault and data corruption in tensorflow-liteEPSS 1.2%CVE-2022-23559HIGHInteger overflow in TFLiteEPSS 1.2%CVE-2022-23581MEDIUM`CHECK`-failures during Grappler's `IsSimplifiableReshape` in TensorflowEPSS 1.2%CVE-2022-23589MEDIUMNull pointer dereference in Grappler's `IsConstant` in TensorflowEPSS 1.1%CVE-2020-15205CRITICALData leak in TensorflowEPSS 1.0%