CVE-2021-29596: 
Python vulnerability analysis and mitigation

TensorFlow is an end-to-end open source platform for machine learning. The implementation of the EmbeddingLookup TFLite operator was found to be vulnerable to a division by zero error in versions prior to 2.5.0. The vulnerability was discovered and disclosed on May 13, 2021, affecting TensorFlow versions before 2.5.0 (TF Advisory).

The vulnerability exists in the implementation of the EmbeddingLookup TFLite operator where a division by zero error can occur. The issue arises when calculating row_bytes using the formula value->bytes / row_size, where row_size is obtained from the first dimension of the value input. If an attacker crafts a model where this first dimension is 0, it leads to a division by zero error (TF Commit). The vulnerability has been assigned a CVSS score of 4.6, indicating medium severity (CISA Bulletin).

The vulnerability could allow an attacker to cause a division by zero error by crafting a model with specific input parameters. This could potentially lead to application crashes or denial of service conditions in systems using the affected TensorFlow versions (TF Advisory).

The vulnerability can be exploited by crafting a model where the first dimension of the 'value' input is 0. This would trigger the division by zero error in the EmbeddingLookup operator implementation (TF Advisory).

The vulnerability has been patched in TensorFlow 2.5.0. The fix has also been backported to TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Users are advised to upgrade to these patched versions to mitigate the vulnerability (TF Advisory).

The vulnerability was reported by members of the Aivul Team from Qihoo 360, demonstrating ongoing security research in the machine learning framework ecosystem (TF Advisory).