title: Division by 0 in `FusedBatchNorm`
description: TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.FusedBatchNorm`. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/828f346274841fa7505f7020e88ca36c22e557ab/tensorflow/core/kernels/fused_batch_norm_op.cc#L295-L297) performs a division based on the last dimension of the `x` tensor. Since this is controlled by the user, an attacker can trigger a denial of service. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
problem types: CWE-369: Divide By Zero
affected:
{
product: tensorflow
vendor: tensorflow
versions:
status: affected, version: < 2.1.4
status: affected, version: >= 2.2.0, < 2.2.3
status: affected, version: >= 2.3.0, < 2.3.3
status: affected, version: >= 2.4.0, < 2.4.2
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
]