deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-0484
Published: 2022-02-04
Description: Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce the victim to add a new cluster via its URL. This issue affects: Mirantis Mirantis Container Cloud Lens Extension v3 versions prior to v3.1.1.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://github.com/Mirantis/security/blob/main/advisories/0005.md; https://github.com/Mirantis/security/blob/main/advisories/0005.md
CVE: CVE-2022-0487
Published: 2022-02-04
Description: A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416, CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=2044561; https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=42933c8aa14be1caa9eda41f65cde8a3a95d3e39; https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html
CVE: CVE-2022-0498
Published: 2022-02-04
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2022-22150
Published: 2022-02-04
Description: A memory corruption vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 11.1.0.52543. A specially-crafted PDF document can trigger an exception which is improperly handled, leaving the engine in an invalid state, which can lead to memory corruption and arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
CVSS Score: 8.8 (HIGH)
CWE: CWE-460, CWE-755
References: https://talosintelligence.com/vulnerability_reports/TALOS-2022-1439; https://talosintelligence.com/vulnerability_reports/TALOS-2022-1439
CVE: CVE-2022-22689
Published: 2022-02-04
Description: CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient input validation, that can allow a privileged user to potentially execute arbitrary code or commands.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1236, CWE-1236
References: https://support.broadcom.com/security-advisory/content/security-advisories/CA20220203-01-Security-Notice-for-CA-Harvest-Software-Change-Manager/ESDSA20297; https://support.broadcom.com/security-advisory/content/security-advisories/CA20220203-01-Security-Notice-for-CA-Harvest-Software-Change-Manager/ESDSA20297
CVE: CVE-2022-22722
Published: 2022-02-04
Description: A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and manipulate traffic associated with product configuration. Affected Product: Easergy P5 (All firmware versions prior to V01.401.101)
CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-03
CVE: CVE-2022-22723
Published: 2022-02-04
Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be impacted. Affected Product: Easergy P5 (All firmware versions prior to V01.401.101)
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-03; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-03
CVE: CVE-2022-22724
Published: 2022-02-04
Description: A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service on ports 80 (HTTP) and 502 (Modbus), when sending a large number of TCP RST or FIN packets to any open TCP port of the PLC. Affected Product: Modicon M340 CPUs: BMXP34 (All Versions)
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-01; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-01
CVE: CVE-2022-22725
Published: 2022-02-04
Description: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be impacted. Affected Product: Easergy P3 (All versions prior to V30.205)
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-04; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-04
CVE: CVE-2022-22726
Published: 2022-02-04
Description: A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the server to be read by authenticated users through a limited operating system service account. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-07; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-07
CVE: CVE-2022-22727
Published: 2022-02-04
Description: A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user�s local machine when the user clicks a specially crafted link. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
CVSS Score: 8.8 (HIGH)
CWE: CWE-20, CWE-20
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-07; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-07
CVE: CVE-2022-22804
Published: 2022-02-04
Description: A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could allow an authenticated attacker to view data, change settings, or impact availability of the software when the user visits a page containing the injected payload. Affected Product: EcoStruxure Power Monitoring Expert (Versions 2020 and prior)
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-07; https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-07
CVE: CVE-2022-22939
Published: 2022-02-04
Description: VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or more log files.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532
References: https://www.vmware.com/security/advisories/VMSA-2022-0003.html; https://www.vmware.com/security/advisories/VMSA-2022-0003.html
CVE: CVE-2022-22987
Published: 2022-02-04
Description: The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform further actions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-321, CWE-798
References: https://www.cisa.gov/uscert/ics/advisories/icsa-22-032-02; https://www.cisa.gov/uscert/ics/advisories/icsa-22-032-02
CVE: CVE-2022-23379
Published: 2022-02-04
Description: Emlog v6.0 was discovered to contain a SQL injection vulnerability via the $TagID parameter of getblogidsfromtagid().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/emlog/emlog/issues/144; https://github.com/emlog/emlog/issues/144
CVE: CVE-2022-23557
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would trigger a division by zero in `BiasAndClamp` implementation. There is no check that the `bias_size` is non zero. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/lite/kernels/internal/common.h#L75; https://github.com/tensorflow/tensorflow/commit/8c6f391a2282684a25cbfec7687bd5d35261a209; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gf2j-f278-xh4v
CVE: CVE-2022-23558
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in `TfLiteIntArrayCreate`. The `TfLiteIntArrayGetSizeInBytes` returns an `int` instead of a `size_t. An attacker can control model inputs such that `computed_size` overflows the size of `int` datatype. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 7.6 (HIGH)
CWE: CWE-190
References: https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/c/common.c#L24-L33; https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/c/common.c#L53-L60; https://github.com/tensorflow/tensorflow/commit/a1e1511dde36b3f8aa27a6ec630838e7ea40e091
CVE: CVE-2022-23559
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication. In certain scenarios, this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.
CVSS Score: 8.8 (HIGH)
CWE: CWE-190, CWE-190
References: https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/embedding_lookup_sparse.cc#L179-L189; https://github.com/tensorflow/tensorflow/commit/1de49725a5fc4e48f1a3b902ec3599ee99283043; https://github.com/tensorflow/tensorflow/commit/a4e401da71458d253b05e41f28637b65baf64be4
CVE: CVE-2022-23560
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors. The fix is included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. Users are advised to upgrade as soon as possible.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/kernels/internal/utils/sparsity_format_converter.cc#L252-L293; https://github.com/tensorflow/tensorflow/commit/6364463d6f5b6254cac3d6aedf999b6a96225038; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4hvf-hxvg-f67v
CVE: CVE-2022-23561
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/tensorflow/tensorflow/commit/6c0b2b70eeee588591680f5b7d5d38175fd7cdf6; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9c78-vcq7-7vxq; https://github.com/tensorflow/tensorflow/commit/6c0b2b70eeee588591680f5b7d5d38175fd7cdf6
CVE: CVE-2022-23562
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. The implementation of `Range` suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 7.6 (HIGH)
CWE: CWE-190
References: https://github.com/tensorflow/tensorflow/commit/f0147751fd5d2ff23251149ebad9af9f03010732; https://github.com/tensorflow/tensorflow/issues/52676; https://github.com/tensorflow/tensorflow/pull/51733
CVE: CVE-2022-23563
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. In multiple places, TensorFlow uses `tempfile.mktemp` to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in `mktemp` and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness). In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the `mktemp` function usage. We have patched the issue in several commits, replacing `mktemp` with the safer `mkstemp`/`mkdtemp` functions, according to the usage pattern. Users are advised to upgrade as soon as possible.
CVSS Score: 7.1 (HIGH)
CWE: CWE-367, CWE-367
References: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wc4g-r73w-x8mm; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wc4g-r73w-x8mm
CVE: CVE-2022-23564
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/tensorflow/tensorflow/commit/14fea662350e7c26eb5fe1be2ac31704e5682ee6; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8rcj-c8pj-v3m3; https://github.com/tensorflow/tensorflow/commit/14fea662350e7c26eb5fe1be2ac31704e5682ee6
CVE: CVE-2022-23565
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. An attacker can trigger denial of service via assertion failure by altering a `SavedModel` on disk such that `AttrDef`s of some operation are duplicated. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617
References: https://github.com/tensorflow/tensorflow/commit/c2b31ff2d3151acb230edc3f5b1832d2c713a9e0; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4v5p-v5h9-6xjx; https://github.com/tensorflow/tensorflow/commit/c2b31ff2d3151acb230edc3f5b1832d2c713a9e0
CVE: CVE-2022-23566
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. TensorFlow is vulnerable to a heap OOB write in `Grappler`. The `set_output` function writes to an array at the specified index. Hence, this gives a malicious user a write primitive. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.h#L394; https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/graph_properties.cc#L1132-L1141; https://github.com/tensorflow/tensorflow/commit/97282c6d0d34476b6ba033f961590b783fa184cd
CVE: CVE-2022-23570
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a `DCHECK`. However, `DCHECK` is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the dereferencing of the null pointer, whereas in the second case it results in a crash due to the assertion failure. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476, CWE-476, CWE-617
References: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L104-L106; https://github.com/tensorflow/tensorflow/commit/8a513cec4bec15961fbfdedcaa[PII_REDACTED]455c; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9p77-mmrw-69c7
CVE: CVE-2022-23571
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments, if the tensors have an invalid `dtype` and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow processes. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-617, CWE-617
References: https://github.com/tensorflow/tensorflow/commit/5b491cd5e41ad63735161cec9c2a568172c8b6a3; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j3mj-fhpq-qqjj; https://github.com/tensorflow/tensorflow/commit/5b491cd5e41ad63735161cec9c2a568172c8b6a3
CVE: CVE-2022-23572
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, TensorFlow can fail to specialize a type during shape inference. This case is covered by the `DCHECK` function however, `DCHECK` is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the `ValueOrDie` line. This results in an assertion failure as `ret` contains an error `Status`, not a value. In the second case we also get a crash due to the assertion failure. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-754, CWE-617
References: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L168-L174; https://github.com/tensorflow/tensorflow/commit/cb164786dc891ea11d3a900e90367c339305dc7b; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rww7-2gpw-fv6j
CVE: CVE-2022-23573
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. The implementation of `AssignOp` can result in copying uninitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 7.6 (HIGH)
CWE: CWE-908
References: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/kernels/assign_op.h#L30-L143; https://github.com/tensorflow/tensorflow/commit/ef1d027be116f25e25bb94a60da491c2cf55bd0b; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q85f-69q7-55h2
CVE: CVE-2022-23574
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's `SpecializeType` which results in heap OOB read/write. Due to a typo, `arg` is initialized to the `i`th mutable argument in a loop where the loop index is `j`. Hence it is possible to assign to `arg` from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
CVSS Score: 8.8 (HIGH)
CWE: CWE-125, CWE-787
References: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L81-L102; https://github.com/tensorflow/tensorflow/commit/0657c83d08845cc434175934c642299de2c0f042; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-77gp-3h4r-6428
CVE: CVE-2022-23575
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateTensorSize` is vulnerable to an integer overflow if an attacker can create an operation which would involve a tensor with large enough number of elements. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L1552-L1558; https://github.com/tensorflow/tensorflow/commit/fcd18ce3101f245b083b30655c27b239dc72221e; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c94w-c95p-phf8
CVE: CVE-2022-23576
Published: 2022-02-04
Description: Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateOutputSize` is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number of dimensions in `output_shape.dim()` or just a small number of dimensions being large enough to cause an overflow in the multiplication. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-190
References: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L1598-L1617; https://github.com/tensorflow/tensorflow/commit/b9bd6cfd1c50e6807846af9a86f9b83cafc9c8ae; https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wm93-f238-7v37