CVEvulnerability
CVE-2022-21740
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-02-03
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-787
Description
Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` is vulnerable to a heap overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Affected configurations
• google tensorflow (<= 2.5.2)
• google tensorflow (>= 2.6.0 <= 2.6.2)
• google tensorflow 2.7.0
Related
Weakness · CWE (1)
- CWE-787 Out-of-bounds Write weakness
References
- https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/count_ops.cc#L168-L273 Exploit, Third Party Advisory
- https://github.com/tensorflow/tensorflow/commit/2b7100d6cdff36aa21010a82269bc05a6d1cc74a Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/commit/adbbabdb0d3abb3cdeac69e38a96de1d678b24b3 Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-44qp-9wwf-734r Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/count_ops.cc#L168-L273 Exploit, Third Party Advisory
- https://github.com/tensorflow/tensorflow/commit/2b7100d6cdff36aa21010a82269bc05a6d1cc74a Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/commit/adbbabdb0d3abb3cdeac69e38a96de1d678b24b3 Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-44qp-9wwf-734r Patch, Third Party Advisory