Veracode Vulnerability DatabaseVERACODE:38146Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
36.8%
tensorflow is vulnerable to denial of service. The vulnerability exists because the Compute function of list_kernels.cc does not properly validate the input size, allowing an attacker to cause an application crash by providing a non-scalar input.
References
github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.cc
github.com/tensorflow/tensorflow/commit/888e34b49009a4e734c27ab0c43b0b5102682c56
github.com/tensorflow/tensorflow/commit/c36c1bbd01fb2b9c99c4a17b07bfeb3d2f9c5d27
github.com/tensorflow/tensorflow/commit/fe61e819bd6787e47a6c6f1528529054496441c4
github.com/tensorflow/tensorflow/commit/feb76c54e7be12837c36d725262b527a3ff1ac9f
github.com/tensorflow/tensorflow/pull/57867
github.com/tensorflow/tensorflow/pull/57868
github.com/tensorflow/tensorflow/pull/57869
github.com/tensorflow/tensorflow/security/advisories/GHSA-67pf-62xr-q35m
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
36.8%