CVE-2022-29207 - 漏洞详情

CVE-2022-29207 (CNNVD-202205-3914)

MEDIUM

中文标题:

Google TensorFlow安全漏洞

英文标题:

Undefined behavior when users supply invalid resource handles in TensorFlow

CVSS分数: 5.5

发布时间: 2022-05-20 22:10:12

漏洞类型: 其他

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

Google TensorFlow是美国谷歌（Google）公司的一套用于机器学习的端到端开源平台。 Google TensorFlow 2.9.0之前版本、2.8.1之前版本、2.7.2之前版本和2.6.4之前版本存在安全漏洞，该漏洞源于当提供给应用的资源句柄无效时，多个tensorflow操作在急切模式下行为异常。

英文描述:

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

CWE类型:

CWE-20 CWE-475

受影响产品

厂商	产品	版本	版本范围	平台	CPE
tensorflow	tensorflow	< 2.6.4	-	-	`cpe:2.3:a:tensorflow:tensorflow:<_2.6.4:::::::*`
tensorflow	tensorflow	>= 2.7.0rc0, < 2.7.2	-	-	`cpe:2.3:a:tensorflow:tensorflow:>=_2.7.0rc0,_<_2.7.2:::::::*`
tensorflow	tensorflow	>= 2.8.0rc0, < 2.8.1	-	-	`cpe:2.3:a:tensorflow:tensorflow:>=_2.8.0rc0,_<_2.8.1:::::::*`
tensorflow	tensorflow	>= 2.9.0rc0, < 2.9.0	-	-	`cpe:2.3:a:tensorflow:tensorflow:>=_2.9.0rc0,_<_2.9.0:::::::*`
google	tensorflow	*	-	-	`cpe:2.3:a:google:tensorflow::::::::`
google	tensorflow	2.7.0	-	-	`cpe:2.3:a:google:tensorflow:2.7.0:rc0::::::`
google	tensorflow	2.8.0	-	-	`cpe:2.3:a:google:tensorflow:2.8.0:-::::::`
google	tensorflow	2.9.0	-	-	`cpe:2.3:a:google:tensorflow:2.9.0:rc0::::::`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）