BIT-tensorflow-2021-29540
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/tensorflow/BIT-tensorflow-2021-29540.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/BIT-tensorflow-2021-29540
- Aliases
- Published
- 2024-03-06T11:19:34.848Z
- Modified
- 2024-11-27T19:40:48.342Z
- Summary
- [none]
- Details
-
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a heap buffer overflow to occur in
Conv2DBackpropFilter. This is because the implementation(https://github.com/tensorflow/tensorflow/blob/1b0296c3b8dd9bd948f924aa8cd62f87dbb7c3da/tensorflow/core/kernels/convgradfilter_ops.cc#L495-L497) computes the size of the filter tensor but does not validate that it matches the number of elements infilter_sizes. Later, when reading/writing to this buffer, code uses the value computed here, instead of the number of elements in the tensor. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range. - Database specific
{ "cpes": [ "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*" ], "severity": "Low" }- References
Affected packages
Bitnami / tensorflow
Package
- Name
- tensorflow
- Purl
- pkg:bitnami/tensorflow
Severity
- 2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator