Lucene search

GoogleOSV:BIT-TENSORFLOW-2022-36027

HistoryMar 06, 2024 - 11:11 a.m.

BIT-tensorflow-2022-36027

2024-03-0611:11:43

Google

osv.dev

tensorflow

machine learning

weight quantization

github

patch

issue

python

cherrypick

supported range

workaround

crash

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

41.9%

JSON

TensorFlow is an open source platform for machine learning. When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process. We have patched the issue in GitHub commit aa0b852a4588cea4d36b74feb05d93055540b450. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

References

github.com/tensorflow/tensorflow/commit/aa0b852a4588cea4d36b74feb05d93055540b450

github.com/tensorflow/tensorflow/issues/53767

github.com/tensorflow/tensorflow/security/advisories/GHSA-79h2-q768-fpxr

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

41.9%

JSON

Related for OSV:BIT-TENSORFLOW-2022-36027