CVE-2021-29555: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to contain a vulnerability (CVE-2021-29555) that allows attackers to cause a denial of service via a FPE runtime error in tf.raw_ops.FusedBatchNorm. The vulnerability was discovered by Ying Wang and Yakun Zhang of Baidu X-Team and affects TensorFlow versions prior to 2.5.0 (GitHub Advisory).

The vulnerability exists in the implementation of FusedBatchNorm operation where a division is performed based on the last dimension of the x tensor. The issue occurs at the code location where const int rest_size = size / depth is calculated, where depth is controlled by user input. When the depth (the 4th element in the input shape) is set to 0, it triggers a floating-point exception (FPE) runtime error (TensorFlow Commit).

When successfully exploited, this vulnerability can lead to a denial of service condition in applications using the affected TensorFlow versions. The attack can be triggered by providing specific input parameters to the FusedBatchNorm operation, causing the application to crash (GitHub Advisory).

The vulnerability has been patched in TensorFlow 2.5.0. The fix has also been backported to TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Users are advised to upgrade to these patched versions. The fix implements a check to prevent division by zero by validating that the 4th element in the input shape is not 0 (GitHub Advisory).