Denial Of Service (DoS)

2022-02-0417:01:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

tensorflow

dos

vulnerability

withrankatleast

segfault

type confusion

EPSS

0.002

Percentile

54.5%

JSON

Tensorflow is vulnerable to denial of service. The vulnerability exists due to an out-of-bounds in WithRankAtLeast allowing an attacker to crash the system via a segfault caused by a type confusion.

References

github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/framework/common_shape_fns.cc#L1961-L2059

github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/framework/shape_inference.cc#L345-L358

github.com/tensorflow/tensorflow/commit/08d7b00c0a5a20926363849f611729f53f3ec022

github.com/tensorflow/tensorflow/pull/53892/commits/f4cb0436d8b790e792bc807ccccf4ded88692179

github.com/tensorflow/tensorflow/pull/53893/commits/4c3b6bde12834b9d26c50b9b007cc59904b32de9

github.com/tensorflow/tensorflow/pull/53894/commits/da4a46539f90377de460ec6dfe75ae89b77e7b58

github.com/tensorflow/tensorflow/security/advisories/GHSA-m4hf-j54p-p353

EPSS

0.002

Percentile

54.5%

JSON

Related for VERACODE:34002