CVE-2021-29586: 
Python vulnerability analysis and mitigation

TensorFlow is an end-to-end open source platform for machine learning. A vulnerability was discovered in the optimized pooling implementations in TensorFlow Lite (CVE-2021-29586), where the code fails to validate that stride arguments are non-zero before calling ComputePaddingHeightWidth. This vulnerability was disclosed on May 13, 2021, affecting TensorFlow versions prior to 2.5.0 (GitHub Advisory).

The vulnerability exists in the optimized pooling implementations where the code does not check that the stride arguments (params->stride_{height,width}) are non-zero before calling ComputePaddingHeightWidth. This oversight allows specially crafted models to set stride values to zero, resulting in a division by zero error (MITRE CVE).

When exploited, this vulnerability can lead to a division by zero error, potentially causing application crashes and denial of service conditions. The severity of this vulnerability is rated as Low, primarily affecting the availability of systems running TensorFlow Lite implementations (GitHub Advisory).

The vulnerability has been patched in multiple versions of TensorFlow. The fix was included in TensorFlow 2.5.0 and was backported to versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Users are advised to upgrade to these patched versions to mitigate the vulnerability (GitHub Advisory).

The vulnerability was reported by members of the Aivul Team from Qihoo 360, demonstrating ongoing security research in the machine learning framework ecosystem (GitHub Advisory).