CVE-2022-21733

Advisory

Tensorflow-gpu versions 2.5.3, 2.6.3, 2.7.1 and 2.8.0 include a fix for CVE-2022-21733: The implementation of 'StringNGrams' can be used to trigger a denial of service attack by causing an out of memory condition after an integer overflow. There is missing a validation on 'pad_witdh' and that result in computing a negative value for 'ngram_width' which is later used to allocate parts of the output.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-98j8-c9q4-r38g

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-98j8-c9q4-r38g
• https://github.com/tensorflow/tensorflow/commit/f68fdab93fb7f4ddb4eb438c8fe052753c9413e8
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21733
• https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/string_ngrams_op.cc#L29-L161