3.6 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:N/A:P
7.3 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
6.8 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
12.6%
TensorFlow is an end-to-end open source platform for machine learning. In affected versions an attacker can trigger a crash via a CHECK
-fail in debug builds of TensorFlow using tf.raw_ops.ResourceGather
or a read from outside the bounds of heap allocated data in the same API in a release build. The implementation does not check that the batch_dims
value that the user supplies is less than the rank of the input tensor. Since the implementation uses several for loops over the dimensions of tensor
, this results in reading data from outside the bounds of heap allocated buffer backing the tensor. We have patched the issue in GitHub commit bc9c546ce7015c57c2f15c168b3d9201de679a1d. The fix will be included in TensorFlow 2.6.0. We will also cherrypick this commit on TensorFlow 2.5.1, TensorFlow 2.4.3, and TensorFlow 2.3.4, as these are also affected and still in supported range.
CPE | Name | Operator | Version |
---|---|---|---|
tensorflow | ge | 2.5.0 | |
tensorflow | ge | 2.3.0 | |
tensorflow | le | 2.5.0 | |
tensorflow | lt | 2.3.4 | |
tensorflow | ge | 2.6.0-rc1 | |
tensorflow | le | 2.6.0-rc1 | |
tensorflow | lt | 2.4.3 | |
tensorflow | ge | 2.4.0 | |
tensorflow | ge | 2.6.0-rc2 | |
tensorflow | le | 2.6.0-rc0 |
3.6 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:N/A:P
7.3 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
6.8 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
12.6%