CVE-2021-29517: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to contain a vulnerability (CVE-2021-29517) related to a division by zero error in its Conv3D implementation. The vulnerability was discovered in early 2021 and affects multiple versions of TensorFlow up to version 2.5.0. The issue occurs when a malicious user can trigger a division by zero operation through user-controlled input in the Conv3D implementation (GitHub Advisory, NVD).

The vulnerability exists in the Conv3D implementation where a modulo operation is performed based on user-controlled input. When the 'filter' parameter has a zero as its fifth element, it results in a division by zero. Additionally, if the shape of two tensors is not valid, an Eigen assertion can be triggered, leading to a program crash. The issue was found in the code at tensorflow/core/kernels/conv_ops_3d.cc. The vulnerability received a CVSS v3.1 base score of 5.5 (MEDIUM) from NVD and 2.5 (LOW) from GitHub (NVD).

The vulnerability can lead to program crashes through two mechanisms: a division by zero error when specific input parameters are provided, and an Eigen assertion failure when invalid tensor shapes are used. This could result in denial of service conditions for applications using the affected TensorFlow versions (GitHub Advisory).

The vulnerability can be exploited by providing malicious input to the Conv3D implementation. A proof of concept exists that demonstrates the vulnerability using specific tensor configurations with zero values in critical positions (GitHub Advisory).

The vulnerability was patched in TensorFlow 2.5.0. The fix was also backported to TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Users are advised to upgrade to these patched versions. The fix was implemented in GitHub commit 799f835a3dfa00a4d852defa29b15841eea9d64f (GitHub Advisory).

The vulnerability was reported by Yakun Zhang and Ying Wang of Baidu X-Team, demonstrating ongoing security research in the machine learning framework space (GitHub Advisory).