Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2022-21733

Memory exhaustion in Tensorflow

Summary

Memory exhaustion in Tensorflow

Original description

The description as published by the source.

Tensorflow is an Open Source Machine Learning Framework. The implementation of StringNGrams can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on pad_witdh and that result in computing a negative value for ngram_width which is later used to allocate parts of the output. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

PyPI tensorflow
[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.1"}]}]
PyPI tensorflow-cpu
[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.1"}]}]
PyPI tensorflow-gpu
[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.1"}]}]
Bitnami tensorflow
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.5.3"},{"introduced":"2.6.0"},{"fixed":"2.6.3"},{"introduced":"2.7.0"},{"fixed":"2.7.1"}]}]

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details