CVE-2021-29517 Information

Description

TensorFlow is an end-to-end open source platform for machine learning. A malicious user could trigger a division by 0 in Conv3D implementation. The implementation(https://github.com/tensorflow/tensorflow/blob/42033603003965bffac51ae171b51801565e002d/tensorflow/core/kernels/conv_ops_3d.ccL143-L145) does a modulo operation based on user controlled input. Thus when filter has a 0 as the fifth element this results in a division by 0. Additionally if the shape of the two tensors is not valid an Eigen assertion can be triggered resulting in a program crash. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2 TensorFlow 2.3.3 TensorFlow 2.2.3 and TensorFlow 2.1.4 as these are also affected and still in supported range.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Reference

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-772p-x54p-hjrv https://github.com/tensorflow/tensorflow/commit/799f835a3dfa00a4d852defa29b15841eea9d64f

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

5.5