CVE-2021-37653: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, was found to contain a vulnerability (CVE-2021-37653) where an attacker could trigger a crash via a floating point exception in tf.raw_ops.ResourceGather. The vulnerability was discovered and disclosed in August 2021, affecting TensorFlow versions prior to 2.6.0 (GitHub Advisory).

The vulnerability exists in the implementation of ResourceGather operation where the code computes a value called batch_size and then performs division using this value without first verifying that it is not zero. This can lead to a floating point exception and subsequent crash. The vulnerability can be triggered by passing specific parameters to the tf.raw_ops.ResourceGather function (GitHub Advisory).

When successfully exploited, this vulnerability results in a crash of the application through a floating point exception. This could lead to denial of service in systems using the affected TensorFlow versions (GitHub Advisory).

The vulnerability has been patched in TensorFlow versions 2.3.4, 2.4.3, 2.5.1, and 2.6.0. Users are advised to upgrade to these patched versions. The fix involves adding a check for zero value before performing the division operation, as implemented in commit ac117ee8a8ea57b73d34665cdf00ef3303bc0b11 (GitHub Advisory).