VYPR
Low severityNVD Advisory· Published May 14, 2021· Updated Aug 3, 2024

Division by 0 in `QuantizedConv2D`

CVE-2021-29527

Description

TensorFlow is an end-to-end open source platform for machine learning. An attacker can trigger a division by 0 in tf.raw_ops.QuantizedConv2D. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/00e9a4d67d76703fa1aee33dac582acf317e0e81/tensorflow/core/kernels/quantized_conv_ops.cc#L257-L259) does a division by a quantity that is controlled by the caller. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.1.42.1.4
tensorflowPyPI
>= 2.2.0, < 2.2.32.2.3
tensorflowPyPI
>= 2.3.0, < 2.3.32.3.3
tensorflowPyPI
>= 2.4.0, < 2.4.22.4.2
tensorflow-cpuPyPI
< 2.1.42.1.4
tensorflow-cpuPyPI
>= 2.2.0, < 2.2.32.2.3
tensorflow-cpuPyPI
>= 2.3.0, < 2.3.32.3.3
tensorflow-cpuPyPI
>= 2.4.0, < 2.4.22.4.2
tensorflow-gpuPyPI
< 2.1.42.1.4
tensorflow-gpuPyPI
>= 2.2.0, < 2.2.32.2.3
tensorflow-gpuPyPI
>= 2.3.0, < 2.3.32.3.3
tensorflow-gpuPyPI
>= 2.4.0, < 2.4.22.4.2

Affected products

1

Patches

1
cfa91be9863a

Fix one FPE and remove two CHECK-fails.

https://github.com/tensorflow/tensorflowMihai MaruseacApr 20, 2021via ghsa
1 file changed · +11 2
  • tensorflow/core/kernels/quantized_conv_ops.cc+11 2 modified
    @@ -18,6 +18,8 @@ limitations under the License.
     #include <algorithm>
     #include <vector>
     
    +#include "tensorflow/core/platform/errors.h"
    +
     #define EIGEN_USE_THREADS
     
     #define GEMMLOWP_ALLOW_SLOW_SCALAR_FALLBACK
    @@ -227,8 +229,12 @@ class Im2ColConvFunctor {
           return;
         }
     
    -    CHECK_GT(output_width, 0);
    -    CHECK_GT(output_height, 0);
    +    OP_REQUIRES(
    +        context, output_width > 0,
    +        errors::InvalidArgument("output_width must be strictly positive"));
    +    OP_REQUIRES(
    +        context, output_height > 0,
    +        errors::InvalidArgument("output_height must be strictly positive"));
         int filter_left_offset;
         int filter_top_offset;
         if (padding == VALID) {
    @@ -255,6 +261,9 @@ class Im2ColConvFunctor {
         // by the width, then the height. This is the standard memory order in the
         // image world if it helps to visualize it.
         const int filter_value_count = filter_width * filter_height * input_depth;
    +    OP_REQUIRES(context, filter_value_count > 0,
    +                errors::InvalidArgument(
    +                    "filter patch must contain at least one element"));
         const int64 patches_per_chunk =
             kMaxChunkSize / (filter_value_count * sizeof(T1));
         const int64 chunk_value_count =
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.