CVE-2021-37683
Division by zero in TensorFlow Lite division operations
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Division by zero in TensorFlow Lite division operations
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
CVE-2021-37683- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-369
- Updated
- 2026-11-02
EUVDEUVD-2021-0409
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
EUVD-2021-0409- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rhrq-64mq-hf9h
FPE in TFLite division operations
Impact
The implementation of division in TFLite is vulnerable to a division by 0 error
There is no check that the divisor tensor does not contain zero elements.
Patches
We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
- Record
GHSA-rhrq-64mq-hf9h- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-369
- Updated
- 2026-11-02
NVD
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
CVE-2021-37683- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-369
- Updated
- 2026-11-02
OSV
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
CVE-2021-37683- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-rhrq-64mq-hf9h
FPE in TFLite division operations
Impact
The implementation of division in TFLite is vulnerable to a division by 0 error
There is no check that the divisor tensor does not contain zero elements.
Patches
We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
- Record
GHSA-rhrq-64mq-hf9h- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-369
- Updated
- 2026-11-02
Show 6 moreShow less
OSVBIT-tensorflow-2021-37683 No score
Division by zero in TensorFlow Lite division operations
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
BIT-tensorflow-2021-37683- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10014-1 No score
Security update for tensorflow2
This update for tensorflow fixes the following issues:
Update to TF2 2.6.0 which fixes multiple CVEs (boo#1189423).
- Introduction of bazel6.3 and basel-skylib1.0.3 as build dependencies. The latter has been adapted to all a version in its package name (if %set_ver_suffix is set to 1). This allows multiple versions to exist for one product (not installed). NOTE: basel-skylib1.0.3 does not exist in oS:Factory: basel-skylib in oS:Factory - the base version - is 1.0.3.
- Record
openSUSE-SU-2022:10014-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12116-1 No score
tensorflow-lite-2.9.1-1.1 on GA media
These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12116-1- Updated
- 2026-11-02
OSVPYSEC-2021-305 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-305- Updated
- 2026-11-02
OSVPYSEC-2021-596 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-596- Updated
- 2026-11-02
OSVPYSEC-2021-794 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of division in TFLite is vulnerable to a division by 0 error. There is no check that the divisor tensor does not contain zero elements. We have patched the issue in GitHub commit 1e206baedf8bef0334cca3eb92bab134ef525a28. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-794- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI |
before 2.3.4 | 2.3.4 |
tensorflowPyPI |
2.4.0 up to 2.4.3 | 2.4.3 |
tensorflowPyPI |
2.5.0 to 2.5.0 | 2.5.1 |
tensorflow-cpuPyPI |
before 2.3.4 | 2.3.4 |
tensorflow-cpuPyPI |
2.4.0 up to 2.4.3 | 2.4.3 |
tensorflow-cpuPyPI |
2.5.0 to 2.5.0 | 2.5.1 |
tensorflow-gpuPyPI |
before 2.3.4 | 2.3.4 |
tensorflow-gpuPyPI |
2.4.0 up to 2.4.3 | 2.4.3 |
tensorflow-gpuPyPI |
2.5.0 to 2.5.0 | 2.5.1 |
tensorflowBitnami |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, 2.5.0 up to 2.5.1 | 2.3.42.4.32.5.1 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI |
before 2.3.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 44 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.3 |
2.3.4 |
tensorflowPyPI |
2.4.0 up to 2.4.3, plus listed versions 2.4.12.4.2 |
2.4.3 |
tensorflowPyPI |
2.5.0 up to 2.5.1 | 2.5.1 |
tensorflow-cpuPyPI |
before 2.3.4, plus listed versions 1.15.02.1.02.1.12.1.22.1.3 Show 9 moreShow less2.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.3 |
2.3.4 |
tensorflow-cpuPyPI |
2.4.0 up to 2.4.3, plus listed versions 2.4.12.4.2 |
2.4.3 |
tensorflow-cpuPyPI |
2.5.0 up to 2.5.1 | 2.5.1 |
tensorflow-gpuPyPI |
before 2.3.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 44 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.3 |
2.3.4 |
tensorflow-gpuPyPI |
2.4.0 up to 2.4.3, plus listed versions 2.4.12.4.2 |
2.4.3 |
tensorflow-gpuPyPI |
2.5.0 up to 2.5.1 | 2.5.1 |
tensorflowPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
tensorflow-cpuPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
tensorflow-gpuPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
bazel-skylib1.0.3SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 1.0.3-bp153.2.1 | 1.0.3-bp153.2.1 |
bazel3.7SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 3.7.2-bp153.4.1 | 3.7.2-bp153.4.1 |
tensorflow2SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2-liteSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-hpcSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-openmpi2-hpcSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
bazel-skylib1.0.3openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 1.0.3-bp153.2.1 | 1.0.3-bp153.2.1 |
bazel3.7openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 3.7.2-bp153.4.1 | 3.7.2-bp153.4.1 |
tensorflow2openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2-liteopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-hpcopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-openmpi2-hpcopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37683 is a medium vulnerability (CVSS 5.5) in Google Tensorflow, published August 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in tensorflow 2.3.4.
References
github.com/tensorflow/tensorflow/security/advisories/GHSA-rhrq-64mq-hf9h
nvd.nist.gov/vuln/detail/CVE-2021-37683
Show 178 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/U25ZU2T5T4LOLSIYIMGC5PLU4PQQMJE5
bugzilla.suse.com/1173128
suse.com/security/cve/CVE-2020-26266