CVE-2022-23559
published 2022-02-04CVE-2022-23559: Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup…
high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication. In certain scenarios, this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | <= 2.5.2 | — | |
| tensorflow | — | — | |
| tensorflow | 2.6.0 – 2.6.2 | — | |
| intel | optimization_for_tensorflow | >= 0 < 2.5.3 | 2.5.3 |
| intel | optimization_for_tensorflow | >= 2.6.0 < 2.6.3 | 2.6.3 |
| intel | optimization_for_tensorflow | >= 2.7.0 < 2.7.1 | 2.7.1 |
| tensorflow | tensorflow | < 2.5.3 | 2.5.3 |
| tensorflow | tensorflow | — | — |
| tensorflow | tensorflow | — | — |