CVE-2021-41207 Division by zero in `ParallelConcat`

2021-11-0521:50:10

CWE-369

GitHub_M

www.cve.org

cve-2021-41207

input validation

tensorflow 2.7.0

cherrypick

machine learning

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

Percentile

12.6%

JSON

TensorFlow is an open source platform for machine learning. In affected versions the implementation of ParallelConcat misses some input validation and can produce a division by 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

CNA Affected

[
  {
    "product": "tensorflow",
    "vendor": "tensorflow",
    "versions": [
      {
        "status": "affected",
        "version": ">= 2.6.0, < 2.6.1"
      },
      {
        "status": "affected",
        "version": ">= 2.5.0, < 2.5.2"
      },
      {
        "status": "affected",
        "version": "< 2.4.4"
      }
    ]
  }
]