CVE-2022-21735

Опубликовано: 03 фев. 2022

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

Tensorflow is an Open Source Machine Learning Framework. The implementation of FractionalMaxPool can be made to crash a TensorFlow process via a division by 0. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Ссылки

https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/fractional_max_pool_op.cc#L36-L192
Exploit
Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/ba4e8ac4dc2991e350d5cc407f8598c8d4ee70fb
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-87v6-crgm-2gfj
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/fractional_max_pool_op.cc#L36-L192
Exploit
Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/ba4e8ac4dc2991e350d5cc407f8598c8d4ee70fb
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-87v6-crgm-2gfj
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия до 2.5.2 (включая)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*

Версия от 2.6.0 (включая) до 2.6.2 (включая)

cpe:2.3:a:google:tensorflow:2.7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 44%

0.0022

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-369

Связанные уязвимости

CVE-2022-21735

CVSS3: 6.5

debian

около 4 лет назад

Tensorflow is an Open Source Machine Learning Framework. The implement ...

GHSA-87v6-crgm-2gfj

CVSS3: 6.5

github

почти 4 года назад

Division by zero in Tensorflow

EPSS

Процентиль: 44%

0.0022

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-369