PYSEC-2021-725

2021-05-1420:15:00

Google

osv.dev

tensorflow

tflite operator

division by zero vulnerability

fix

upcoming versions

machine learning

open source

software

cherrypick

commit

supported range

EPSS

0.001

Percentile

17.8%

JSON

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the Split TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/e2752089ef7ce9bcf3db0ec618ebd23ea119d0c7/tensorflow/lite/kernels/split.cc#L63-L65). An attacker can craft a model such that num_splits would be 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.