CVE-2021-29587: Division by zero in TFLite's implementation of `SpaceToDepth`
Impact The Prepare step of the SpaceToDepth TFLite operator does not check for 0 before division.
cc const int blocksize = params->blocksize; const int inputheight = input->dims->data[1]; const int inputwidth = input->dims->data[2]; int outputheight = inputheight / blocksize; int outputwidth = inputwidth / blocksize;
An attacker can craft a model such that params->blocksize would be zero.
Patches We have patched the issue in GitHub commit 0d45ea1ca641b21b73bcf9c00e0179cda284e7e7.
The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Other sources
TensorFlow is an end-to-end open source platform for machine learning. The Prepare step of the SpaceToDepth TFLite operator does not check for 0 before division(https://github.com/tensorflow/tensorflow/blob/5f7975d09eac0f10ed8a17dbb6f5964977725adc/tensorflow/lite/kernels/spacetodepth.cc#L63-L67). An attacker can craft a model such that params->blocksize would be zero. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-29587?
CVE-2021-29587 is classified as a high severity vulnerability due to its impact on the SpaceToDepth TFLite operator's handling of division by zero.
How do I fix CVE-2021-29587?
To fix CVE-2021-29587, update TensorFlow to version 2.4.2 or later.
What versions of TensorFlow are affected by CVE-2021-29587?
CVE-2021-29587 affects TensorFlow versions from 2.1.0 up to but not including 2.4.2.
What impact does CVE-2021-29587 have on applications using TensorFlow?
CVE-2021-29587 can lead to application crashes or unexpected behavior when using the SpaceToDepth operator with invalid parameters.
Is CVE-2021-29587 related to any other vulnerabilities in TensorFlow?
CVE-2021-29587 is specific to the SpaceToDepth operator and does not have direct relationships with other reported vulnerabilities in TensorFlow.