PYSEC-2022-68

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow-cpu/PYSEC-2022-68.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2022-68
Aliases
Published
2022-02-04T23:15:00Z
Modified
2023-12-06T00:46:57.671422Z
Summary
[none]
Details

Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both embedding_size and lookup_size are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication. In certain scenarios, this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.

References

Affected packages

PyPI / tensorflow-cpu

Package

Name
tensorflow-cpu
View open source insights on deps.dev
Purl
pkg:pypi/tensorflow-cpu

Affected ranges

Type
GIT
Repo
https://github.com/tensorflow/tensorflow
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a4e401da71458d253b05e41f28637b65baf64be4
Fixed
1de49725a5fc4e48f1a3b902ec3599ee99283043
Fixed
f19be71717c497723ba0cea0379e84f061a75e01
Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.5.3
Introduced
2.6.0
Fixed
2.6.3

Affected versions

1.*

1.15.0

2.*

2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.5.0
2.5.1
2.5.2
2.6.0
2.6.1
2.6.2