CVE-2022-21737Improper Check for Unusual or Exceptional Conditions in Intel Optimization FOR Tensorflow

Severity
6.5MEDIUMNVD
EPSS
0.2%
top 55.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedFeb 3
Latest updateFeb 9

Description

Tensorflow is an Open Source Machine Learning Framework. The implementation of `*Bincount` operations allows malicious users to cause denial of service by passing in arguments which would trigger a `CHECK`-fail. There are several conditions that the input arguments must satisfy. Some are not caught during shape inference and others are not caught during kernel implementation. This results in `CHECK` failures later when the output tensors get allocated. The fix will be included in TensorFlow 2.8.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

PyPIintel/optimization_for_tensorflow2.6.02.6.3+2
NVDgoogle/tensorflow2.6.02.6.2+2

Patches

🔴Vulnerability Details

4
GHSA
Assertion failure based denial of service in Tensorflow2022-02-09
OSV
Assertion failure based denial of service in Tensorflow2022-02-09
OSV
CVE-2022-21737: Tensorflow is an Open Source Machine Learning Framework2022-02-03
CVEList
Assertion failure based denial of service in Tensorflow2022-02-03

📋Vendor Advisories

1
Debian
CVE-2022-21737: tensorflow - Tensorflow is an Open Source Machine Learning Framework. The implementation of `...2022
CVE-2022-21737 — Intel vulnerability | cvebase