CVE-2021-37636 — Vulnetix

CVE-2021-37636 PUBLISHED

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseDenseCwiseDiv` is vulnerable to a division by 0 error. The [implementation](https://github.com/tensorflow/tensorflow/blob/a1bc56203f21a5a4995311825ffaba7a670d7747/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L56) uses a common class for all binary operations but fails to treat the division by 0 case separately. We have patched the issue in GitHub commit d9204be9f49520cdaaeb2541d1dc5187b23f31d9. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

EPSS 0.01% · 1.5th percentile

Risk Scores

EPSS Score

0.01%

1.5th percentile

Affected Products

Vendor	Product	Versions
Bitnami	tensorflow	2.3.0, 2.4.0, 2.5.0
Bitnami	tensorflow	2.3.0, 2.4.0, 2.5.0

Timeline

Aug 12, 2021 CVE Published
Aug 13, 2021 EPSS Score
Oct 10, 2021 EPSS Score
Dec 7, 2021 EPSS Score
Jan 6, 2022 EPSS Score
Feb 3, 2022 EPSS Score
Apr 2, 2022 EPSS Score
May 30, 2022 EPSS Score
Jul 28, 2022 EPSS Score
Sep 24, 2022 EPSS Score
Nov 21, 2022 EPSS Score
Jan 18, 2023 EPSS Score

References

Open in Interactive Console →