PYSEC-2022-123

2022-02-0423:15:00

Google

osv.dev

0.002 Low

EPSS

Percentile

64.9%

JSON

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both embedding_size and lookup_size are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication. In certain scenarios, this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.

CPENameOperatorVersion
tensorflow-gpueq1.13.2
tensorflow-gpueq2.4.0
tensorflow-gpueq1.12.3
tensorflow-gpueq2.5.0
tensorflow-gpueq1.0.1
tensorflow-gpueq1.13.1
tensorflow-gpueq2.0.1
tensorflow-gpueq2.4.1
tensorflow-gpueq2.5.2
tensorflow-gpueq2.6.1

Name	Operator	Version
tensorflow-gpu	eq	1.13.2
tensorflow-gpu	eq	2.4.0
tensorflow-gpu	eq	1.12.3
tensorflow-gpu	eq	2.5.0
tensorflow-gpu	eq	1.0.1
tensorflow-gpu	eq	1.13.1
tensorflow-gpu	eq	2.0.1
tensorflow-gpu	eq	2.4.1
tensorflow-gpu	eq	2.5.2
tensorflow-gpu	eq	2.6.1