CVE-2021-29585: Division by zero in padding computation in TFLite
(updated )
The TFLite computation for size of output after padding, ComputeOutSize, does not check that the stride argument is not 0 before doing the division.
inline int ComputeOutSize(TfLitePadding padding, int image_size,
int filter_size, int stride, int dilation_rate = 1) {
int effective_filter_size = (filter_size - 1) * dilation_rate + 1;
switch (padding) {
case kTfLitePaddingSame:
return (image_size + stride - 1) / stride;
case kTfLitePaddingValid:
return (image_size + stride - effective_filter_size) / stride;
default:
return 0;
}
}
Users can craft special models such that ComputeOutSize is called with stride set to 0.
References
- github.com/advisories/GHSA-mv78-g7wq-mhp4
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2021-513.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2021-711.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2021-222.yaml
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/blob/0c9692ae7b1671c983569e5d3de5565843d500cf/tensorflow/lite/kernels/padding.h
- github.com/tensorflow/tensorflow/commit/49847ae69a4e1a97ae7f2db5e217c77721e37948
- github.com/tensorflow/tensorflow/security/advisories/GHSA-mv78-g7wq-mhp4
- nvd.nist.gov/vuln/detail/CVE-2021-29585
Code Behaviors & Features
Detect and mitigate CVE-2021-29585 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →