CVE-2021-29599: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to contain a vulnerability in the implementation of the Split TFLite operator. The vulnerability (CVE-2021-29599) was discovered in May 2021 and affects multiple versions of TensorFlow before 2.5.0. The vulnerability allows an attacker to trigger a division by zero error by crafting a model where the num_splits parameter would be set to 0 (TF Advisory).

The vulnerability exists in the Split TFLite operator implementation where a division operation is performed without validating that the divisor (num_splits) is non-zero. The vulnerable code is located in the split.cc file, specifically in the division operation where slice_size = input_size / num_splits. The vulnerability received a CVSS v3.1 base score of 7.8 (HIGH) from NVD, while GitHub assessed it with a base score of 2.5 (LOW) (NVD).

If successfully exploited, this vulnerability could lead to a division by zero error, potentially causing program crashes or denial of service conditions. The vulnerability affects multiple versions of TensorFlow, including versions prior to 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 (NVD).

An attacker can exploit this vulnerability by crafting a specific model where the num_splits parameter is set to 0. The vulnerability was reported by members of the Aivul Team from Qihoo 360 (TF Advisory).

The vulnerability has been patched in TensorFlow 2.5.0. The fix includes adding a validation check to ensure that num_splits is not zero before performing the division operation. The patch has also been backported to TensorFlow versions 2.4.2, 2.3.3, 2.2.3, and 2.1.4. Users are advised to upgrade to these patched versions (TF Advisory).