AVID-2026-R0909

Description

Integer division by 0 in tf.raw_ops.AllToAll (CVE-2021-41218)

Details

TensorFlow is an open source platform for machine learning. In affected versions the shape inference code for AllToAll can be made to execute a division by 0. This occurs whenever the split_count argument is 0. The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

Reason for inclusion in AVID: The report describes CVE-2021-41218, a vulnerability in TensorFlow’s AllToAll shape inference (divide-by-zero). TensorFlow is a core ML framework used to build/train/deploy AI systems, so this is a software supply-chain issue within AI software stacks. It is a CVE-style security vulnerability with defined affected versions and a fix, satisfying evidence for AVID curation.

References

Affected or Relevant Artifacts

Developer: tensorflow
Deployer: tensorflow
Artifact Details:

Type	Name
System	tensorflow

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score	5.5
Base Severity	🟠 Medium
Attack Vector	LOCAL
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	🔴 High

CWE

ID	Description
CWE-369	CWE-369: Divide By Zero

Other information

Report Type: Advisory
Credits:
Date Reported: 2021-11-05
Version: 0.3.3
AVID Entry