Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

TensorFlow's Machine Learning Model May Crash with Zero Input

CVE-2021-37680 · published 5 years ago
Summary

TensorFlow's machine learning model may crash or produce incorrect results if it encounters zero input values, which can happen when using certain types of neural networks. This issue affects users who rely on TensorFlow's fully connected layers, such as those working with image or speech recognition. To fix this issue, update to the latest version of TensorFlow or apply the patches provided for affected versions.

What to do
  • Update google inc. tensorflow to version 2.3.4.
  • Update google inc. tensorflow to version 2.4.3.
  • Update google inc. tensorflow to version 2.5.1.
  • Update google inc. tensorflow-cpu to version 2.3.4.
  • Update google inc. tensorflow-cpu to version 2.4.3.
  • Update google tensorflow-gpu to version 2.3.4.
  • Update google tensorflow-gpu to version 2.4.3.
  • Update google tensorflow-gpu to version 2.5.1.
  • Update google inc. tensorflow-cpu to version 2.5.1.
Affected software
Ecosystem VendorProductAffected versions
pip google inc. tensorflow < 2.3.4
>= 2.4.0, < 2.4.3
2.5.0
Fix: upgrade to 2.3.4
pip google inc. tensorflow-cpu < 2.3.4
>= 2.4.0, < 2.4.3
2.5.0
Fix: upgrade to 2.3.4
pip google tensorflow-gpu < 2.3.4
>= 2.4.0, < 2.4.3
2.5.0
Fix: upgrade to 2.3.4
– google tensorflow >= 2.3.0, < 2.3.4
>= 2.4.0, < 2.4.3
2.5.0
2.6.0
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Original advisory text
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of fully connected layers in TFLite is [vulnerable to a division by zero error](https:...
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of fully connected layers in TFLite is [vulnerable to a division by zero error](https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/lite/kernels/fully_connected.cc#L226). We have patched the issue in GitHub commit 718721986aa137691ee23f03638867151f74935f. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-369Divide By Zero
Timeline
Published12 Aug 2021
Updated26 Oct 2026
First seen6 Mar 2026
Sources
GHSA-cfpj-3q4c-jhvr · GHSA
CVE-2021-37680 · NVD
Track software like this
Free during beta