CVE-2021-29595

Description

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the `DepthToSpace` TFLite operator is vulnerable to a division by zero error(https://github.com/tensorflow/tensorflow/blob/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7/tensorflow/lite/kernels/depth_to_space.cc#L63-L69). An attacker can craft a model such that `params->block_size` is 0. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

How to fix CVE-2021-29595

To remediate CVE-2021-29595, upgrade the affected package to a fixed version below.

—upgrade to 2.1.4 or later
—upgrade to 2.1.4 or later
—upgrade to 106d8f4fb89335a2c52d7c895b7a7485465ca8d9 or later
—upgrade to 106d8f4fb89335a2c52d7c895b7a7485465ca8d9 or later
—upgrade to 2.1.4 or later
—upgrade to 106d8f4fb89335a2c52d7c895b7a7485465ca8d9 or later
—upgrade to 2.1.4 or later

Is CVE-2021-29595 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (7)

from 0, < 2.1.4, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.3, >= 2.4.0, < 2.4.2
from 0, < 2.1.4
from 0, < 106d8f4fb89335a2c52d7c895b7a7485465ca8d9 | from 0, < 2.1.4, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.4, >= 2.4.0, < 2.4.3
from 0, < 106d8f4fb89335a2c52d7c895b7a7485465ca8d9 | from 0, < 2.1.4, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.4, >= 2.4.0, < 2.4.3
from 0, < 2.1.4
from 0, < 106d8f4fb89335a2c52d7c895b7a7485465ca8d9 | from 0, < 2.1.4, >= 2.2.0, < 2.2.3, >= 2.3.0, < 2.3.4, >= 2.4.0, < 2.4.3
from 0, < 2.1.4

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
osv	CVSS 3.1	LOW2.5	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L