Описание
TensorFlow is an end-to-end open source platform for machine learning. The implementation of ParseAttrValue(https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/framework/attr_value_util.cc#L397-L453) can be tricked into stack overflow due to recursion by giving in a specially crafted input. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.
Ссылки
- PatchThird Party Advisory
- ExploitPatchThird Party Advisory
- PatchThird Party Advisory
- ExploitPatchThird Party Advisory
Уязвимые конфигурации
Одно из
EPSS
2.5 Low
CVSS3
5.5 Medium
CVSS3
2.1 Low
CVSS2
Дефекты
Связанные уязвимости
TensorFlow is an end-to-end open source platform for machine learning. ...
Stack overflow in `ParseAttrValue` with nested tensors
EPSS
2.5 Low
CVSS3
5.5 Medium
CVSS3
2.1 Low
CVSS2