Skip to content
OpenAdvisories
Medium · 5.5 CVE-2021-37640 BIT-tensorflow-2021-37640EUVD-2021-0366GHSA-95xm-g58g-3p88PYSEC-2021-262PYSEC-2021-553PYSEC-2021-751

Integer division by 0 in sparse reshaping in TensorFlow

Published Aug 12, 2021 · Updated Aug 4, 2024 · Assigned by GitHub_M

Description

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseReshape` can be made to trigger an integral division by 0 exception. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L176-L181) calls the reshaping functor whenever there is at least an index in the input but does not check that shape of the input or the target shape have both a non-zero number of elements. The [reshape functor](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/reshape_util.cc#L40-L78) blindly divides by the dimensions of the target shape. Hence, if this is not checked, code will result in a division by 0. We have patched the issue in GitHub commit 4923de56ec94fff7770df259ab7f2288a74feb41. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1 as this is the other affected version.

Affected products

VendorProductAffectedFixed
tensorflow tensorflow < 2.5.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP3 bazel-skylib1.0.3 1.0.3-bp153.2.1 openSUSE-SU-2022:10014-1
SUSE Package Hub 15 SP3 bazel3.7 3.7.2-bp153.4.1 openSUSE-SU-2022:10014-1
SUSE Package Hub 15 SP3 tensorflow2 +3 2.6.0-bp153.2.3.1 openSUSE-SU-2022:10014-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.3 bazel-skylib1.0.3 1.0.3-bp153.2.1 openSUSE-SU-2022:10014-1
openSUSE Leap 15.3 bazel3.7 3.7.2-bp153.4.1 openSUSE-SU-2022:10014-1
openSUSE Leap 15.3 tensorflow2 +3 2.6.0-bp153.2.3.1 openSUSE-SU-2022:10014-1

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tensorflow < 2.3.4 2.3.4 GHSA-95xm-g58g-3p88
PyPI tensorflow >= 2.4.0, < 2.4.3 2.4.3 GHSA-95xm-g58g-3p88
PyPI tensorflow >= 2.5.0, < 2.5.1 2.5.1 GHSA-95xm-g58g-3p88
PyPI tensorflow >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.3.4, 2.4.3 PYSEC-2021-262
PyPI tensorflow-cpu < 2.3.4 2.3.4 GHSA-95xm-g58g-3p88
PyPI tensorflow-cpu >= 2.4.0, < 2.4.3 2.4.3 GHSA-95xm-g58g-3p88
PyPI tensorflow-cpu >= 2.5.0, < 2.5.1 2.5.1 GHSA-95xm-g58g-3p88
PyPI tensorflow-cpu >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.3.4, 2.4.3 PYSEC-2021-553
PyPI tensorflow-gpu < 2.3.4 2.3.4 GHSA-95xm-g58g-3p88
PyPI tensorflow-gpu >= 2.4.0, < 2.4.3 2.4.3 GHSA-95xm-g58g-3p88
PyPI tensorflow-gpu >= 2.5.0, < 2.5.1 2.5.1 GHSA-95xm-g58g-3p88
PyPI tensorflow-gpu >= 2.3.0, < 2.3.4 · >= 2.4.0, < 2.4.3 2.3.4, 2.4.3 PYSEC-2021-751

Advisories 1

References