CVE-2021-41218: Integer division by 0 in `tf.raw_ops.AllToAll`
Impact The shape inference code for AllToAll can be made to execute a division by 0:
python import tensorflow as tf @tf.function def func(): return tf.rawops.AllToAll( input=[0.0, 0.1652, 0.6543], groupassignment=[1, -1], concatdimension=0, splitdimension=0, splitcount=0)
func()
This occurs whenever the splitcount argument is 0: cc TFRETURNIFERROR(c->GetAttr("splitcount", &splitcount)); ... for (int32t i = 0; i < rank; ++i) { ... dims[i] = c->MakeDim(c->Value(dims[i]) / splitcount); ... }
Patches We have patched the issue in GitHub commit a8ad3e5e79c75f36edb81e0ba3f3c0c5442aeddc.
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Other sources
TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for AllToAll can be made to execute a division by 0. This occurs whenever the splitcount argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-41218?
CVE-2021-41218 is classified with a medium severity due to the potential for a division by zero which can lead to application crashes.
How do I fix CVE-2021-41218?
To fix CVE-2021-41218, upgrade to TensorFlow version 2.4.4, 2.5.2, or 2.6.1 as appropriate for your installation.
Which versions of TensorFlow are affected by CVE-2021-41218?
CVE-2021-41218 affects TensorFlow versions 2.4.0 to 2.4.4, 2.6.0 to 2.6.1, and the 2.7.0 release candidates.
Is CVE-2021-41218 a critical vulnerability?
CVE-2021-41218 is not considered a critical vulnerability but still requires attention due to its impact on application stability.
What happens if I do not address CVE-2021-41218?
If CVE-2021-41218 is not addressed, applications using vulnerable versions of TensorFlow may experience crashes during execution.