CVE-2021-37684
Division by zero in TensorFlow Lite pooling operations
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Division by zero in TensorFlow Lite pooling operations
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
CVE-2021-37684- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-369
- Updated
- 2026-11-02
EUVDEUVD-2021-0410
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
EUVD-2021-0410- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q7f7-544h-67h9
FPE in TFLite pooling operations
Impact
The implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0.
Patches
We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
- Record
GHSA-q7f7-544h-67h9- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-369
- Updated
- 2026-11-02
NVD
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
CVE-2021-37684- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-369
- Updated
- 2026-11-02
OSV
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
CVE-2021-37684- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-q7f7-544h-67h9
FPE in TFLite pooling operations
Impact
The implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0.
Patches
We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695.
The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
- Record
GHSA-q7f7-544h-67h9- CVSS 4.0
- 6.8 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-369
- Updated
- 2026-11-02
Show 6 moreShow less
OSVBIT-tensorflow-2021-37684 No score
Division by zero in TensorFlow Lite pooling operations
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
BIT-tensorflow-2021-37684- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10014-1 No score
Security update for tensorflow2
This update for tensorflow fixes the following issues:
Update to TF2 2.6.0 which fixes multiple CVEs (boo#1189423).
- Introduction of bazel6.3 and basel-skylib1.0.3 as build dependencies. The latter has been adapted to all a version in its package name (if %set_ver_suffix is set to 1). This allows multiple versions to exist for one product (not installed). NOTE: basel-skylib1.0.3 does not exist in oS:Factory: basel-skylib in oS:Factory - the base version - is 1.0.3.
- Record
openSUSE-SU-2022:10014-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12116-1 No score
tensorflow-lite-2.9.1-1.1 on GA media
These are all security issues fixed in the tensorflow-lite-2.9.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12116-1- Updated
- 2026-11-02
OSVPYSEC-2021-306 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-306- Updated
- 2026-11-02
OSVPYSEC-2021-597 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-597- Updated
- 2026-11-02
OSVPYSEC-2021-795 No score
TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementations of pooling in TFLite are vulnerable to division by 0 errors as there are no checks for divisors not being 0. We have patched the issue in GitHub commit dfa22b348b70bb89d6d6ec0ff53973bacb4f4695. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
- Record
PYSEC-2021-795- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI |
before 2.3.4 | 2.3.4 |
tensorflowPyPI |
2.4.0 up to 2.4.3 | 2.4.3 |
tensorflowPyPI |
2.5.0 to 2.5.0 | 2.5.1 |
tensorflow-cpuPyPI |
before 2.3.4 | 2.3.4 |
tensorflow-cpuPyPI |
2.4.0 up to 2.4.3 | 2.4.3 |
tensorflow-cpuPyPI |
2.5.0 to 2.5.0 | 2.5.1 |
tensorflow-gpuPyPI |
before 2.3.4 | 2.3.4 |
tensorflow-gpuPyPI |
2.4.0 up to 2.4.3 | 2.4.3 |
tensorflow-gpuPyPI |
2.5.0 to 2.5.0 | 2.5.1 |
tensorflowBitnami |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, 2.5.0 up to 2.5.1 | 2.3.42.4.32.5.1 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tensorflowPyPI |
before 2.3.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 44 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.3 |
2.3.4 |
tensorflowPyPI |
2.4.0 up to 2.4.3, plus listed versions 2.4.12.4.2 |
2.4.3 |
tensorflowPyPI |
2.5.0 up to 2.5.1 | 2.5.1 |
tensorflow-cpuPyPI |
before 2.3.4, plus listed versions 1.15.02.1.02.1.12.1.22.1.3 Show 9 moreShow less2.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.3 |
2.3.4 |
tensorflow-cpuPyPI |
2.4.0 up to 2.4.3, plus listed versions 2.4.12.4.2 |
2.4.3 |
tensorflow-cpuPyPI |
2.5.0 up to 2.5.1 | 2.5.1 |
tensorflow-gpuPyPI |
before 2.3.4, plus listed versions 0.12.00.12.11.0.01.0.11.1.0 Show 44 moreShow less1.10.01.10.11.11.01.12.01.12.21.12.31.13.11.13.21.14.01.15.01.15.21.15.31.15.41.15.51.2.01.2.11.3.01.4.01.4.11.5.01.5.11.6.01.7.01.7.11.8.01.9.02.0.02.0.12.0.22.0.32.0.42.1.02.1.12.1.22.1.32.1.42.2.02.2.12.2.22.2.32.3.02.3.12.3.22.3.3 |
2.3.4 |
tensorflow-gpuPyPI |
2.4.0 up to 2.4.3, plus listed versions 2.4.12.4.2 |
2.4.3 |
tensorflow-gpuPyPI |
2.5.0 up to 2.5.1 | 2.5.1 |
tensorflowPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
tensorflow-cpuPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
tensorflow-gpuPyPI |
2.3.0 up to 2.3.4, 2.4.0 up to 2.4.3, plus listed versions 2.3.12.3.22.3.32.4.12.4.2 |
2.3.42.4.3 |
bazel-skylib1.0.3SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 1.0.3-bp153.2.1 | 1.0.3-bp153.2.1 |
bazel3.7SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 3.7.2-bp153.4.1 | 3.7.2-bp153.4.1 |
tensorflow2SUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2-liteSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-hpcSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-openmpi2-hpcSUSE:Package Hub 15 SP3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
bazel-skylib1.0.3openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 1.0.3-bp153.2.1 | 1.0.3-bp153.2.1 |
bazel3.7openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 3.7.2-bp153.4.1 | 3.7.2-bp153.4.1 |
tensorflow2openSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2-liteopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-hpcopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
tensorflow2_2_6_0-gnu-openmpi2-hpcopenSUSE:Leap 15.3 From an advisory covering 63 CVEs |
before 2.6.0-bp153.2.3.1 | 2.6.0-bp153.2.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37684 is a medium vulnerability (CVSS 5.5) in Google Tensorflow, published August 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in tensorflow 2.3.4.
References
github.com/tensorflow/tensorflow/security/advisories/GHSA-q7f7-544h-67h9
nvd.nist.gov/vuln/detail/CVE-2021-37684
Show 176 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/U25ZU2T5T4LOLSIYIMGC5PLU4PQQMJE5
bugzilla.suse.com/1173128
suse.com/security/cve/CVE-2020-26266