CVE-2018-10055 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Google Tensorflow

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents6 sources

Severity

8.1HIGHNVD

EPSS

0.2%

top 61.22%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Tensorflow Intel Optimization FOR Tensorflow

Timeline

PublishedApr 24

Latest updateJan 22

Description

Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:HExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶NVDgoogle/tensorflow< 1.7.1

▶PyPIintel/optimization_for_tensorflow1.1.0 — 1.7.1+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

OSV

Improper Restriction of Operations within the Bounds of a Memory Buffer in Google TensorFlow↗2019-04-30

▶

GHSA

Improper Restriction of Operations within the Bounds of a Memory Buffer in Google TensorFlow↗2019-04-30

▶

OSV

CVE-2018-10055: Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1↗2019-04-24

▶

CVEList

CVE-2018-10055: Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1↗2019-04-24

▶

📋Vendor Advisories

Debian

CVE-2018-10055: tensorflow - Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compil...↗2018

▶

📄Research Papers

arXiv

On managing vulnerabilities in AI/ML systems↗2021-01-22

▶