Google TensorFlow buffer overflow vulnerability (CNVD-2022-11506)

Google TensorFlow is an end-to-end open source platform for machine learning from Google (USA). Google Tensorflow suffers from a buffer overflow vulnerability that stems from the fact that the implementation of FractionalAvgPoolGrad does not account for invalid input tensor, which can be exploited by an attacker to read from outside the boundaries of the heap.