CVE-2022-21733 — Integer Overflow or Wraparound in Intel Optimization FOR Tensorflow

CWE-190 — Integer Overflow or WraparoundCWE-400 — Uncontrolled Resource Consumption6 documents5 sources
Severity
6.5MEDIUMNVD
CNA4.3
EPSS
0.2%
top 53.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Intel Optimization FOR TensorflowGoogle Tensorflow
Timeline
PublishedFeb 3
Latest updateFeb 10

Description

Tensorflow is an Open Source Machine Learning Framework. The implementation of `StringNGrams` can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. We are missing a validation on `pad_witdh` and that result in computing a negative value for `ngram_width` which is later used to allocate parts of the output. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and Tensor…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶PyPIintel/optimization_for_tensorflow2.6.0 — 2.6.3+2
▶NVDgoogle/tensorflow2.6.0 — 2.6.2+2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Memory exhaustion in Tensorflow↗2022-02-10
▶
OSV
Memory exhaustion in Tensorflow↗2022-02-10
▶
CVEList
Memory exhaustion in Tensorflow↗2022-02-03
▶
OSV
CVE-2022-21733: Tensorflow is an Open Source Machine Learning Framework↗2022-02-03
▶

📋Vendor Advisories

1
Debian
CVE-2022-21733: tensorflow - Tensorflow is an Open Source Machine Learning Framework. The implementation of `...↗2022
▶
CVE-2022-21733 — Integer Overflow or Wraparound | cvebase