CVE-2022-21736 — NULL Pointer Dereference in Intel Optimization FOR Tensorflow

CWE-476 — NULL Pointer Dereference6 documents5 sources
Severity
6.5MEDIUMNVD
CNA7.6
EPSS
0.3%
top 43.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Intel Optimization FOR TensorflowGoogle Tensorflow
Timeline
PublishedFeb 3
Latest updateFeb 9

Description

Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseTensorSliceDataset` has an undefined behavior: under certain condition it can be made to dereference a `nullptr` value. The 3 input arguments to `SparseTensorSliceDataset` represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorF…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶PyPIintel/optimization_for_tensorflow2.6.0 — 2.6.3+2
▶NVDgoogle/tensorflow2.6.0 — 2.6.2+2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
GHSA
Undefined behavior in `SparseTensorSliceDataset`↗2022-02-09
▶
OSV
Undefined behavior in `SparseTensorSliceDataset`↗2022-02-09
▶
OSV
CVE-2022-21736: Tensorflow is an Open Source Machine Learning Framework↗2022-02-03
▶
CVEList
Undefined behavior in Tensorflow↗2022-02-03
▶

📋Vendor Advisories

1
Debian
CVE-2022-21736: tensorflow - Tensorflow is an Open Source Machine Learning Framework. The implementation of `...↗2022
▶
CVE-2022-21736 — NULL Pointer Dereference in Intel | cvebase