CVE-2022-23576Integer Overflow or Wraparound in Tensorflow

Severity
6.5MEDIUMNVD
EPSS
0.2%
top 55.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedFeb 4
Latest updateFeb 10

Description

Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateOutputSize` is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number of dimensions in `output_shape.dim()` or just a small number of dimensions being large enough to cause an overflow in the multiplication. The fix will be included in TensorFlow 2.8.0. We will also cher

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

CVEListV5tensorflow/tensorflow< 2.5.3+2
PyPIintel/optimization_for_tensorflow2.6.02.6.3+2
NVDgoogle/tensorflow2.6.02.6.2+2

Patches

🔴Vulnerability Details

4
OSV
Integer overflow in Tensorflow2022-02-10
GHSA
Integer overflow in Tensorflow2022-02-10
CVEList
Integer overflow in Tensorflow2022-02-04
OSV
CVE-2022-23576: Tensorflow is an Open Source Machine Learning Framework2022-02-04

📋Vendor Advisories

1
Debian
CVE-2022-23576: tensorflow - Tensorflow is an Open Source Machine Learning Framework. The implementation of `...2022
CVE-2022-23576 — Integer Overflow or Wraparound | cvebase