CVE-2021-29587: Division by zero in TFLite's implementation of `SpaceToDepth`
(updated )
The Prepare
step of the SpaceToDepth
TFLite operator does not check for 0 before division.
const int block_size = params->block_size;
const int input_height = input->dims->data[1];
const int input_width = input->dims->data[2];
int output_height = input_height / block_size;
int output_width = input_width / block_size;
An attacker can craft a model such that params->block_size
would be zero.
References
- github.com/advisories/GHSA-j7rm-8ww4-xx2g
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-515.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-713.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-224.yaml
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/blob/5f7975d09eac0f10ed8a17dbb6f5964977725adc/tensorflow/lite/kernels/space_to_depth.cc
- github.com/tensorflow/tensorflow/commit/0d45ea1ca641b21b73bcf9c00e0179cda284e7e7
- github.com/tensorflow/tensorflow/security/advisories/GHSA-j7rm-8ww4-xx2g
- nvd.nist.gov/vuln/detail/CVE-2021-29587
Detect and mitigate CVE-2021-29587 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →