BIT-tensorflow-2021-37691

2024-03-0611:16:41

Google

osv.dev

tensorflow

tflite

vulnerability

patch

github

commit

lsh

division by zero

2.6.0

cherrypick

2.5.1

2.4.3

2.3.4

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.3%

JSON

TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can craft a TFLite model that would trigger a division by zero error in LSH implementation. We have patched the issue in GitHub commit 0575b640091680cfb70f4dd93e70658de43b94f9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick thiscommit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

CPENameOperatorVersion
tensorflowge2.6.0-rc1
tensorflowge2.6.0-rc0
tensorflowge2.6.0-rc2
tensorflowle2.6.0-rc1
tensorflowge2.5.0
tensorflowge2.4.0
tensorflowle2.6.0-rc0
tensorflowge2.3.0
tensorflowlt2.3.4
tensorflowle2.6.0-rc2

Name	Operator	Version
tensorflow	ge	2.6.0-rc1
tensorflow	ge	2.6.0-rc0
tensorflow	ge	2.6.0-rc2
tensorflow	le	2.6.0-rc1
tensorflow	ge	2.5.0
tensorflow	ge	2.4.0
tensorflow	le	2.6.0-rc0
tensorflow	ge	2.3.0
tensorflow	lt	2.3.4
tensorflow	le	2.6.0-rc2