Lucene search

K
cvelistGitHub_MCVELIST:CVE-2022-21733
HistoryFeb 03, 2022 - 11:28 a.m.

CVE-2022-21733 Memory exhaustion in Tensorflow

2022-02-0311:28:10
GitHub_M
www.cve.org
10
tensorflow
memory exhaustion
integer overflow
stringngrams
denial of service
validation
allocation
fix
tensorflow 2.8.0
cherry pick
tensorflow 2.7.1
tensorflow 2.6.3
tensorflow 2.5.3
supported range

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS

0.002

Percentile

51.9%

Tensorflow is an Open Source Machine Learning Framework. The implementation of StringNGrams can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on pad_witdh and that result in computing a negative value for ngram_width which is later used to allocate parts of the output. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS

0.002

Percentile

51.9%

Related for CVELIST:CVE-2022-21733