Veracode Vulnerability DatabaseVERACODE:38156Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
36.9%
Tensorflow is vulnerable to denial of service. The vulnerability exists because the input size of BCast::ToShape is not properly handled which allows an attacker to crash the application by sending inputs larger than int32.
References
github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h
github.com/tensorflow/tensorflow/commit/4da5db22b5a3dc57f34c957cd1ea7e665bc0f8ce
github.com/tensorflow/tensorflow/commit/8310bf8dd188ff780e7fc53245058215a05bdbe5
github.com/tensorflow/tensorflow/commit/8b10d7f2502c2ae543cb38012a9b0f8ae072d347
github.com/tensorflow/tensorflow/commit/e4df861d9a19764008690c4689d640eee2af2557
github.com/tensorflow/tensorflow/security/advisories/GHSA-h246-cgh4-7475
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
0.001 Low
EPSS
Percentile
36.9%