CVE-2022-23557

Katalog CVE

CVSS 6.5 · Medium EPSS 0,76%

Kerentanan Divide By Zero pada google tensorflow. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would trigger a division by zero in `BiasAndClamp` implementation. There is no check that the `bias_size` is non zero. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Rincian

Terbit di NVD

4 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-369: Divide By Zero

EPSS (30 hari)

0,76% peluang dieksploitasi; lebih tinggi dari 54,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tensorflow/tensorflow/commit/8c6f391a2282684a25cbfec7687bd5d35261a209 patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gf2j-f278-xh4v patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/lite/kernels... exploit · advisory pihak ketiga