Vulnerability Details : CVE-2021-37684
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695). The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Exploit prediction scoring system (EPSS) score for CVE-2021-37684
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 10 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2021-37684
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:N/A:P |
3.9
|
2.9
|
NIST |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2021-37684
-
The product divides a value by zero.Assigned by: security-advisories@github.com (Primary)
References for CVE-2021-37684
-
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q7f7-544h-67h9
FPE in TFLite pooling operations · Advisory · tensorflow/tensorflow · GitHubThird Party Advisory
Products affected by CVE-2021-37684
- cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.6.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.6.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.6.0:rc2:*:*:*:*:*:*