CVE-2021-37680: 
Python vulnerability analysis and mitigation

TensorFlow, an end-to-end open source platform for machine learning, reported a vulnerability (CVE-2021-37680) in its implementation of fully connected layers in TFLite. The vulnerability was discovered and disclosed in August 2021, affecting TensorFlow versions prior to 2.6.0. The issue was concurrently reported by members of the Aivul Team from Qihoo 360 and Yakun Zhang of Baidu Security (GitHub Advisory).

The vulnerability stems from a division by zero error in the fully connected layers implementation within TFLite. Specifically, the issue occurs in the calculation const int batch_size = input_size / filter->dims->data[1], where there was no validation to ensure that filter->dims->data[1] is non-zero (GitHub Commit).

An attacker could potentially craft a malicious TensorFlow Lite model where the filter->dims->data[1] value is set to zero, triggering a division by zero error. This could lead to program crashes and potential denial of service conditions (GitHub Advisory).

The issue was patched in TensorFlow 2.6.0 and backported to versions 2.5.1, 2.4.3, and 2.3.4. The fix involves adding a validation check to ensure that filter->dims->data[1] is not zero before performing the division operation. Users are advised to upgrade to these patched versions (GitHub Advisory).