CVE-2021-29522 : Vulnerability Insights and Analysis

TensorFlow is an end-to-end open source platform for machine learning. The

tf.raw_ops.Conv3DBackprop*

operations fail to validate that the input tensors are not empty, leading to a division by 0 vulnerability. Attackers controlling input sizes can trigger a denial of service via a division by zero error. The issue affects TensorFlow versions < 2.1.4, >= 2.2.0 and < 2.2.3, >= 2.3.0 and < 2.3.3, and >= 2.4.0 and < 2.4.2. A fix is included in TensorFlow 2.5.0, with cherry-picked commits for affected supported versions.

Understanding CVE-2021-20657

This section provides insights into the nature and impact of the vulnerability.

What is CVE-2021-20657?

CVE-2021-29522 is a vulnerability in TensorFlow that allows for a denial of service attack via a division by zero error. The issue originates from improper validation of input tensors in

Conv3DBackprop*

operations.

The Impact of CVE-2021-20657

The vulnerability poses a low-severity threat with a base score of 2.5 (Low). It requires low privileges and no user interaction but has a high attack complexity and a local attack vector. Although it has a low severity, the potential for denial of service makes it a meaningful risk.

Technical Details of CVE-2021-20657

This section delves into the specific technical aspects of the CVE.

Vulnerability Description

The vulnerability arises from the failure to check divisor validity in computing shard size, potentially allowing attackers to induce a division by zero situation.

Affected Systems and Versions

TensorFlow versions < 2.1.4, >= 2.2.0 and < 2.2.3, >= 2.3.0 and < 2.3.3, and >= 2.4.0 and < 2.4.2 are all impacted by this vulnerability.

Exploitation Mechanism

Attackers can exploit this vulnerability by manipulating input sizes to trigger the division by zero error.

Mitigation and Prevention

This section outlines actions to mitigate and prevent the CVE.

Immediate Steps to Take

Update to TensorFlow 2.5.0 to fix the vulnerability or apply the cherry-picked commits on versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4.

Long-Term Security Practices

Regularly update TensorFlow to the latest version to ensure all security patches are applied.

Patching and Updates

Stay informed about security advisories and promptly apply patches to secure your TensorFlow installations.