CVE-2022-29203

Katalog CVE

CVSS 5.5 · Medium EPSS 0,34%

Kerentanan Integer Overflow or Wraparound pada google tensorflow. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SpaceToBatchND` (in all backends such as XLA and handwritten kernels) is vulnerable to an integer overflow: The result of this integer overflow is used to allocate the output tensor, hence we get a denial of service via a `CHECK`-failure (assertion failure), as in TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Rincian

Terbit di NVD

20 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/commit/acd56b8bcb72b163c834ae4f18469047b001fadf patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jjm6-4vf7-cjh4 exploit · patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 release notes · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 release notes · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 release notes · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 release notes · advisory pihak ketiga