AVID-2026-R0869

Description

Division by zero in TFLite in TensorFlow (CVE-2021-37680)

Details

TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of fully connected layers in TFLite is vulnerable to a division by zero error. We have patched the issue in GitHub commit 718721986aa137691ee23f03638867151f74935f. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.

Reason for inclusion in AVID: The CVE describes a software vulnerability in TensorFlow’s TFLite implementation (dividing by zero) affecting AI model inference components. TensorFlow/TFLite are core AI frameworks/tools used in building, training, deploying, and serving general-purpose AI systems, making this a software supply-chain issue within AI stacks. The report provides concrete signals: CVE entry, affected versions, a GitHub commit fixing the issue, and planned inclusion in releases, establishing sufficient evidence of a security vulnerability in AI software components.

References

• NVD entry
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cfpj-3q4c-jhvr
• https://github.com/tensorflow/tensorflow/commit/718721986aa137691ee23f03638867151f74935f

Affected or Relevant Artifacts

• Developer: tensorflow
• Deployer: tensorflow
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CVSS

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2021-08-12
• Version: 0.3.3
• AVID Entry