Vulnerability Description
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.ResourceScatterDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/resource_variable_ops.cc#L865) uses a common class for all binary operations but fails to treat the division by 0 case separately. We have patched the issue in GitHub commit 4aacb30888638da75023e6601149415b39763d76. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tensorflow | >= 2.3.0, < 2.3.4 |
Related Weaknesses (CWE)
References
- https://github.com/tensorflow/tensorflow/commit/4aacb30888638da75023e6601149415bPatchThird Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-ch4f-829c-v5pwThird Party Advisory
- https://github.com/tensorflow/tensorflow/commit/4aacb30888638da75023e6601149415bPatchThird Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-ch4f-829c-v5pwThird Party Advisory
FAQ
What is CVE-2021-37642?
CVE-2021-37642 is a vulnerability with a CVSS score of 5.5 (MEDIUM). TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.ResourceScatterDiv` is vulnerable to a division by 0 error. The [implement...
How severe is CVE-2021-37642?
CVE-2021-37642 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-37642?
Check the references section above for vendor advisories and patch information. Affected products include: Google Tensorflow.