What is CVE-2021-37684?

CVE-2021-37684 is a medium-severity vulnerability in Google Tensorflow, classified under Divide By Zero. CVSS score: 5.5/10. Published 2021-08-12.

How severe is CVE-2021-37684?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Google Tensorflow

CVE-2021-37684

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit [dfa22b348b70bb89d6d6ec0ff53973bacb4f4695](https://github.com/tensorflow/tensorflow/commit/dfa22b348b70bb89d6d6ec0ff53973bacb4f4695). The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

EPSS: 0.001 (3.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Google Tensorflow — versions 2.5.0, 2.6.0
Tensorflow — versions >= 2.5.0, < 2.5.1, >= 2.4.0, < 2.4.3, < 2.3.4

Weakness classification (CWE)

CWE-369 — Divide By Zero

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)

Frequently asked questions

What is CVE-2021-37684?: CVE-2021-37684 is a medium-severity vulnerability in Google Tensorflow, classified under Divide By Zero. CVSS score: 5.5/10. Published 2021-08-12.
How severe is CVE-2021-37684?: Medium severity. CVSS v3 base score is 5.5 out of 10.