CVE-2021-37642: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to have a vulnerability in the implementation of tf.raw_ops.ResourceScatterDiv that made it susceptible to a division by zero error. The vulnerability, identified as CVE-2021-37642, was discovered by members of the Aivul Team from Qihoo 360 and affected TensorFlow versions prior to 2.6.0 (GitHub Advisory).

The vulnerability exists in the implementation of tf.raw_ops.ResourceScatterDiv, which uses a common class for all binary operations but fails to handle the division by zero case separately. The issue was present in the resourcevariableops.cc file, where the implementation did not validate input values for zero before performing division operations (TF Commit).

When exploited, this vulnerability could lead to division by zero errors in TensorFlow applications. A simple proof of concept demonstrates the vulnerability: import tensorflow as tf; v= tf.Variable([1,2,3]); tf.raw_ops.ResourceScatterDiv(resource=v.handle, indices=[1], updates=[0]) (GitHub Advisory).

The issue has been patched in TensorFlow 2.6.0 and backported to versions 2.5.1, 2.4.3, and 2.3.4. The fix implements input validation to prevent division by zero operations. Users are recommended to upgrade to these patched versions (GitHub Advisory).