TROYANOSYVIRUS
Back to CVEs

CVE-2021-29586

LOW
2.5

Description

TensorFlow is an end-to-end open source platform for machine learning. Optimized pooling implementations in TFLite fail to check that the stride arguments are not 0 before calling `ComputePaddingHeightWidth`(https://github.com/tensorflow/tensorflow/blob/3f24ccd932546416ec906a02ddd183b48a1d2c83/tensorflow/lite/kernels/pooling.cc#L90). Since users can craft special models which will have `params->stride_{height,width}` be zero, this will result in a division by zero. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

CVE Details

CVSS v3.1 Score2.5
SeverityLOW
CVSS VectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack VectorLOCAL
ComplexityHIGH
Privileges RequiredLOW
User InteractionNONE
Published5/14/2021
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0

Affected Products

google:tensorflow

Weaknesses (CWE)

CWE-369

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.