CVE-2022-23576
Assigner: GitHub_M
Published: 2022-02-04T22:32:22
State: PUBLISHED
affected: product: tensorflow
vendor: tensorflow
versions: status: affected
version: >= 2.7.0, < 2.7.1
status: affected
version: >= 2.6.0, < 2.6.3
status: affected
version: < 2.5.3
descriptions: value: Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateOutputSize` is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number of dimensions in `output_shape.dim()` or just a small number of dimensions being large enough to cause an overflow in the multiplication. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-190
description: CWE-190: Integer Overflow or Wraparound
type: CWE
source: advisory: GHSA-wm93-f238-7v37
discovery: UNKNOWN
title: Integer overflow in Tensorflow