CVE-2021-29586: Division by zero in optimized pooling implementations in TFLite
Impact Optimized pooling implementations in TFLite fail to check that the stride arguments are not 0 before calling ComputePaddingHeightWidth.
Since users can craft special models which will have params->stride{height,width} be zero, this will result in a division by zero. Patches We have patched the issue in GitHub commit 5f7975d09eac0f10ed8a17dbb6f5964977725adc. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Other sources
TensorFlow is an end-to-end open source platform for machine learning. Optimized pooling implementations in TFLite fail to check that the stride arguments are not 0 before calling ComputePaddingHeightWidth(https://github.com/tensorflow/tensorflow/blob/3f24ccd932546416ec906a02ddd183b48a1d2c83/tensorflow/lite/kernels/pooling.cc#L90). Since users can craft special models which will have params->stride{height,width} be zero, this will result in a division by zero. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29586?
CVE-2021-29586 is classified as a medium severity vulnerability due to its potential impact on TFLite's optimized pooling implementations.
How do I fix CVE-2021-29586?
To mitigate CVE-2021-29586, upgrade to TensorFlow versions 2.4.2, 2.3.3, 2.2.3, or 2.1.4.
What systems are affected by CVE-2021-29586?
CVE-2021-29586 affects TensorFlow versions 2.4.0 and prior for both CPU and GPU installations.
Can CVE-2021-29586 lead to application crashes?
Yes, CVE-2021-29586 can lead to application crashes if the vulnerable pooling implementations are triggered with erroneous inputs.
Who is responsible for addressing CVE-2021-29586?
Developers using the affected versions of TensorFlow are responsible for updating their software to address CVE-2021-29586.