CVE-2021-29557
published 2021-05-14CVE-2021-29557: TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.19%
8.9th percentile
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.SparseMatMul`. The division by 0 occurs deep in Eigen code because the `b` tensor is empty. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | < 2.1.4 | 2.1.4 | |
| tensorflow | >= 2.2.0 < 2.2.3 | 2.2.3 | |
| tensorflow | >= 2.3.0 < 2.3.3 | 2.3.3 | |
| tensorflow | >= 2.4.0 < 2.4.2 | 2.4.2 | |
| intel | optimization_for_tensorflow | >= 0 < 2.1.4 | 2.1.4 |
| intel | optimization_for_tensorflow | >= 0 < 7f283ff806b2031f407db64c4d3edcda8fb9f9f5 | 7f283ff806b2031f407db64c4d3edcda8fb9f9f5 |
| intel | optimization_for_tensorflow | >= 2.2.0 < 2.2.3 | 2.2.3 |
| intel | optimization_for_tensorflow | >= 2.3.0 < 2.3.3 | 2.3.3 |
| intel | optimization_for_tensorflow | >= 2.4.0 < 2.4.2 | 2.4.2 |
| tensorflow | tensorflow | < 2.1.4 | 2.1.4 |
| tensorflow | tensorflow | — | — |
| tensorflow | tensorflow | — | — |
| tensorflow | tensorflow | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
vendor_debian2.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Division by 0 in `SparseMatMul`
osv·2021-05-21
CVE-2021-29557 [LOW] Division by 0 in `SparseMatMul`
Division by 0 in `SparseMatMul`
### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.SparseMatMul`:
```python
import tensorflow as tf
a = tf.constant([100.0, 100.0, 100.0, 100.0], shape=[2, 2], dtype=tf.float32)
b = tf.constant([], shape=[0, 2], dtype=tf.float32)
tf.raw_ops.SparseMatMul(
a=a, b=b, transpose_a=True, transpose_b=True,
a_is_sparse=True, b_is_sparse=True)
```
The division by 0 occurs deep in Eigen code because the `b` tensor is empty.
### Patches
We have patched the issue in GitHub commit [7f283ff806b2031f407db64c4d3edcda8fb9f9f5](https://github.com/tensorflow/tensorflow/commit/7f283ff806b2031f407db64c4d3edcda8fb9f9f5).
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow
GHSA
Division by 0 in `SparseMatMul`
ghsa·2021-05-21
CVE-2021-29557 [LOW] CWE-369 Division by 0 in `SparseMatMul`
Division by 0 in `SparseMatMul`
### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.SparseMatMul`:
```python
import tensorflow as tf
a = tf.constant([100.0, 100.0, 100.0, 100.0], shape=[2, 2], dtype=tf.float32)
b = tf.constant([], shape=[0, 2], dtype=tf.float32)
tf.raw_ops.SparseMatMul(
a=a, b=b, transpose_a=True, transpose_b=True,
a_is_sparse=True, b_is_sparse=True)
```
The division by 0 occurs deep in Eigen code because the `b` tensor is empty.
### Patches
We have patched the issue in GitHub commit [7f283ff806b2031f407db64c4d3edcda8fb9f9f5](https://github.com/tensorflow/tensorflow/commit/7f283ff806b2031f407db64c4d3edcda8fb9f9f5).
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow
OSV
CVE-2021-29557: TensorFlow is an end-to-end open source platform for machine learning
osv·2021-05-14
CVE-2021-29557 CVE-2021-29557: TensorFlow is an end-to-end open source platform for machine learning
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.SparseMatMul`. The division by 0 occurs deep in Eigen code because the `b` tensor is empty. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Debian
CVE-2021-29557: tensorflow - TensorFlow is an end-to-end open source platform for machine learning. An attack...
vendor_debian·2021·CVSS 2.5
CVE-2021-29557 [LOW] CVE-2021-29557: tensorflow - TensorFlow is an end-to-end open source platform for machine learning. An attack...
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.SparseMatMul`. The division by 0 occurs deep in Eigen code because the `b` tensor is empty. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Scope: local
forky: resolved
sid: resolved
Suricata
ET EXPLOIT D-Link DIR-825 R1 Web Interface RCE (CVE-2020-29557)
suricata·2021-10-28·CVSS 9.8
CVE-2020-29557 [CRITICAL] ET EXPLOIT D-Link DIR-825 R1 Web Interface RCE (CVE-2020-29557)
ET EXPLOIT D-Link DIR-825 R1 Web Interface RCE (CVE-2020-29557)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT D-Link DIR-825 R1 Web Interface RCE (CVE-2020-29557)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/check_browser?lang="; nocase; fast_pattern; isdataat:100,relative; reference:url,shaqed.github.io/dlink/; reference:cve,2020-29557; classtype:attempted-admin; sid:2034280; rev:2; metadata:attack_target Networking_Equipment, created_at 2021_10_28, cve CVE_2020_29557, deployment Perimeter, deployment Internal, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2024_05_22;)
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/tensorflow/tensorflow/commit/7f283ff806b2031f407db64c4d3edcda8fb9f9f5https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xw93-v57j-fcghhttps://github.com/tensorflow/tensorflow/commit/7f283ff806b2031f407db64c4d3edcda8fb9f9f5https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xw93-v57j-fcgh
2021-05-14
Published