CVE-2021-41209: FPE in convolutions with zero size filters
5.5
Basic Information
PythonTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | >= 2.6.0, < 2.6.1 | 2.6.1 |
| tensorflow | pip | >= 2.5.0, < 2.5.2 | 2.5.2 |
| tensorflow | pip | < 2.4.4 | 2.4.4 |
| tensorflow-cpu | pip | >= 2.6.0, < 2.6.1 | 2.6.1 |
| tensorflow-cpu | pip | >= 2.5.0, < 2.5.2 | 2.5.2 |
| tensorflow-cpu | pip | < 2.4.4 | 2.4.4 |
| tensorflow-gpu | pip | >= 2.6.0, < 2.6.1 | 2.6.1 |
| tensorflow-gpu | pip | >= 2.5.0, < 2.5.2 | 2.5.2 |
| tensorflow-gpu | pip | < 2.4.4 | 2.4.4 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability description explicitly mentions convolution operators in tensorflow/core/kernels/conv_ops.cc as the source of the division-by-zero issue. However, the provided commit diff (f2c3931) shows changes to tensorflow/core/kernels/inplace_ops.cc (ParallelConcatUpdate::Compute) and test files, which are unrelated to convolution operations. This creates a contradiction between the vulnerability description and the actual patched code shown in the commit. Without observing the pre-patch code in conv_ops.cc or additional context linking the commit to convolution operator validation, we cannot confidently identify specific vulnerable functions in the convolution implementations. The provided data suggests either a misassociation of the commit with the CVE or incomplete code context for analysis.