CVE-2022-21729: TensorFlow - Division by Zero Vulnerability
Summary
CVE-2022-21729: Overflow and uncaught divide by zero in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-21729 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in the implementation of the UnravelIndex function, which can lead to a division by zero due to an integer overflow bug.
Vulnerability Detail
The vulnerability in TensorFlow's UnravelIndex function arises from an integer overflow bug. This bug can cause a division by zero, leading to unexpected behavior or crashes in applications that rely on this function. An attacker could potentially exploit this vulnerability to execute arbitrary code or cause a denial of service. The impact of this vulnerability is considered medium severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to apply the fix by updating TensorFlow to the latest patched version.
Conclusion
The division by zero vulnerability in TensorFlow's UnravelIndex function has been addressed by the TensorFlow team. Users are advised to update their TensorFlow installations to the latest patched version to mitigate the risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a wide range of tools and resources for building and deploying machine learning models.
The vulnerability can lead to a division by zero, causing unexpected behavior or crashes in applications that use the affected function. It could potentially be exploited by attackers to execute arbitrary code or cause a denial of service.
The vulnerability affects TensorFlow versions 2.5.2, 2.6.0, 2.6.1, 2.6.2, and 2.7.0. The fix has been backported to TensorFlow 2.5.3, 2.6.3, and 2.7.1, which are still within the supported range.
To fix this vulnerability, you should update your TensorFlow installation to the latest patched version. Detailed instructions for updating TensorFlow can be found in the official documentation.
No specific workaround has been provided for this vulnerability. It is recommended to apply the fix by updating TensorFlow to the latest patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
