CVE-2021-29587: 
Python vulnerability analysis and mitigation

TensorFlow's TFLite implementation of the SpaceToDepth operator contained a division by zero vulnerability (CVE-2021-29587) discovered in May 2021. The vulnerability affected TensorFlow versions prior to 2.5.0, where the Prepare step of the operator failed to validate the block_size parameter before performing division operations (GitHub Advisory).

The vulnerability exists in the Prepare function of the SpaceToDepth TFLite operator where division operations are performed using block_size without first validating that it is non-zero. The vulnerable code calculates output_height = input_height / block_size and output_width = input_width / block_size without proper validation (GitHub Commit).

If exploited, an attacker could craft a model with a zero block_size parameter, leading to a division by zero error that could cause the application to crash, potentially resulting in a denial of service condition (GitHub Advisory).

The issue was patched in TensorFlow 2.5.0 and backported to versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4. The fix involves adding a validation check to ensure block_size is greater than zero before performing division operations (GitHub Advisory).