VIR Vulnerability Intelligence Relay

CVE-2022-21737

unknown
Published 2022-02-09 · Modified 2023-12-06
CVSS v3
—
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v2
—
VIR risk
—

Description

Tensorflow is an Open Source Machine Learning Framework. The implementation of `*Bincount` operations allows malicious users to cause denial of service by passing in arguments which would trigger a `CHECK`-fail. There are several conditions that the input arguments must satisfy. Some are not caught during shape inference and others are not caught during kernel implementation. This results in `CHECK` failures later when the output tensors get allocated. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Predictions

Exploit likelihood
30%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2022-21737

OS impact
OSVersionStatusFixed in
debian debiansidfixed0
debian debianforkyfixed0

Package impact
EcosystemPackageVulnerableFixed
python PyPItensorflow<2.5.32.5.3
python PyPItensorflow>=2.6.0,<2.6.32.6.3
python PyPItensorflow>=2.7.0,<2.7.12.7.1
python PyPItensorflow-cpu<2.5.32.5.3
python PyPItensorflow-cpu>=2.6.0,<2.6.32.6.3
python PyPItensorflow-cpu>=2.7.0,<2.7.12.7.1
python PyPItensorflow-gpu<2.5.32.5.3
python PyPItensorflow-gpu>=2.6.0,<2.6.32.6.3
python PyPItensorflow-gpu>=2.7.0,<2.7.12.7.1
python PyPItensorflow-gpu<7019ce4f68925fd01cdafde26f8d8c938f47e6f9||>=2.6.0,<2.6.37019ce4f68925fd01cdafde26f8d8c938f47e6f9
python PyPItensorflow-cpu<7019ce4f68925fd01cdafde26f8d8c938f47e6f9||>=2.6.0,<2.6.37019ce4f68925fd01cdafde26f8d8c938f47e6f9

References

Verify integrity in audit chain (admin only). AS-IS.