OOB read in `Gather_nd` op in TensorFlow Lite
CVE-2022-35937

7HIGH

Key Information:

Vendor

Tensorflow
Status
Tensorflow
Vendor
CVE Published:
16 September 2022

What is CVE-2022-35937?

TensorFlow is an open source platform for machine learning. The GatherNd function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. This issue has been patched in GitHub commit 595a65a3e224a0362d7e68c2213acfc2b499a196. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Affected Version(s)

tensorflow < 2.7.2 < 2.7.2

tensorflow >= 2.8.0, < 2.8.1 < 2.8.0, 2.8.1

tensorflow >= 2.9.0, < 2.9.1 < 2.9.0, 2.9.1

References

https://github.com/tensorflow/tensorflow/security/advisor...
x_refsource_CONFIRM
https://github.com/tensorflow/tensorflow/commit/595a65a3e...
x_refsource_MISC
https://github.com/tensorflow/tensorflow/blob/f463040eb39...
x_refsource_MISC

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.