CVE-2022-21734

Опубликовано: 03 фев. 2022

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

Tensorflow is an Open Source Machine Learning Framework. The implementation of MapStage is vulnerable a CHECK-fail if the key tensor is not a scalar. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Ссылки

https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/map_stage_op.cc#L519-L550
Exploit
Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/f57315566d7094f322b784947093406c2aea0d7d
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gcvh-66ff-4mwm
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/map_stage_op.cc#L519-L550
Exploit
Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/f57315566d7094f322b784947093406c2aea0d7d
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gcvh-66ff-4mwm
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия до 2.5.2 (включая)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия от 2.6.0 (включая) до 2.6.2 (включая)

cpe:2.3:a:google:tensorflow:2.7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 44%

0.0022

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-843

Связанные уязвимости

CVE-2022-21734

CVSS3: 6.5

debian

около 4 лет назад

Tensorflow is an Open Source Machine Learning Framework. The implement ...

GHSA-gcvh-66ff-4mwm

CVSS3: 6.5

github

почти 4 года назад

`CHECK`-failures in Tensorflow

EPSS

Процентиль: 44%

0.0022

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-843