PYSEC-2022-102
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/tensorflow-cpu/PYSEC-2022-102.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2022-102
- Aliases
- Published
- 2022-02-04T23:15:00Z
- Modified
- 2023-12-06T01:02:01.723228Z
- Summary
- [none]
- Details
-
Tensorflow is an Open Source Machine Learning Framework. The
simplifyBroadcastfunction in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, thenmaxRankis 0, so we build an emptySmallVector. The fix will be included in TensorFlow 2.8.0. This is the only affected version. - References
-
- https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/mlir/tfrt/jit/transforms/tf_cpurt_symbolic_shape_optimization.cc#L149-L205
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gwcx-jrx4-92w2
- https://github.com/tensorflow/tensorflow/commit/35f0fabb4c178253a964d7aabdbb15c6a398b69a
Affected packages
PyPI / tensorflow-cpu
Package
- Name
- tensorflow-cpu
- View open source insights on deps.dev
- Purl
- pkg:pypi/tensorflow-cpu