CVE-2021-29554
published 2021-05-14CVE-2021-29554: TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.19%
8.7th percentile
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/kernels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result is 0 before doing the division. Since `data` is given by the `values` argument, `num_batch_elements` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, and TensorFlow 2.3.3, as these are also affected.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | < 2.1.4 | 2.1.4 | |
| tensorflow | >= 2.2.0 < 2.2.3 | 2.2.3 | |
| tensorflow | >= 2.3.0 < 2.3.3 | 2.3.3 | |
| tensorflow | >= 2.4.0 < 2.4.2 | 2.4.2 | |
| intel | optimization_for_tensorflow | >= 0 < da5ff2daf618591f64b2b62d9d9803951b945e9f | da5ff2daf618591f64b2b62d9d9803951b945e9f |
| intel | optimization_for_tensorflow | >= 0 < 2.1.4 | 2.1.4 |
| intel | optimization_for_tensorflow | >= 2.2.0 < 2.2.3 | 2.2.3 |
| intel | optimization_for_tensorflow | >= 2.3.0 < 2.3.3 | 2.3.3 |
| intel | optimization_for_tensorflow | >= 2.4.0 < 2.4.2 | 2.4.2 |
| tensorflow | tensorflow | < 2.3.3 | 2.3.3 |
| tensorflow | tensorflow | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
vendor_debian2.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Division by 0 in `DenseCountSparseOutput`
osv·2021-05-21
CVE-2021-29554 [LOW] Division by 0 in `DenseCountSparseOutput`
Division by 0 in `DenseCountSparseOutput`
### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`:
```python
import tensorflow as tf
values = tf.constant([], shape=[0, 0], dtype=tf.int64)
weights = tf.constant([])
tf.raw_ops.DenseCountSparseOutput(
values=values, weights=weights,
minlength=-1, maxlength=58, binary_output=True)
```
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/kernels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result is 0 before doing the division:
```cc
int num_batch_elements = 1;
for (int i = 0; i < num_batch_dimensions; ++i) {
num_batch_elements *= data.shape().dim_
GHSA
Division by 0 in `DenseCountSparseOutput`
ghsa·2021-05-21
CVE-2021-29554 [LOW] CWE-369 Division by 0 in `DenseCountSparseOutput`
Division by 0 in `DenseCountSparseOutput`
### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`:
```python
import tensorflow as tf
values = tf.constant([], shape=[0, 0], dtype=tf.int64)
weights = tf.constant([])
tf.raw_ops.DenseCountSparseOutput(
values=values, weights=weights,
minlength=-1, maxlength=58, binary_output=True)
```
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/kernels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result is 0 before doing the division:
```cc
int num_batch_elements = 1;
for (int i = 0; i < num_batch_dimensions; ++i) {
num_batch_elements *= data.shape().dim_
OSV
CVE-2021-29554: TensorFlow is an end-to-end open source platform for machine learning
osv·2021-05-14
CVE-2021-29554 CVE-2021-29554: TensorFlow is an end-to-end open source platform for machine learning
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/kernels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result is 0 before doing the division. Since `data` is given by the `values` argument, `num_batch_elements` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, and TensorFlow 2.3.3, as these are also affected.
Debian
CVE-2021-29554: tensorflow - TensorFlow is an end-to-end open source platform for machine learning. An attack...
vendor_debian·2021·CVSS 2.5
CVE-2021-29554 [LOW] CVE-2021-29554: tensorflow - TensorFlow is an end-to-end open source platform for machine learning. An attack...
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/kernels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result is 0 before doing the division. Since `data` is given by the `values` argument, `num_batch_elements` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, and TensorFlow 2.3.3, as these are also affected.
Scope: local
forky: resolved
sid: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/tensorflow/tensorflow/commit/da5ff2daf618591f64b2b62d9d9803951b945e9fhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-qg48-85hg-mqc5https://github.com/tensorflow/tensorflow/commit/da5ff2daf618591f64b2b62d9d9803951b945e9fhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-qg48-85hg-mqc5
2021-05-14
Published