by Kastro
Paper/Archive/CVE-2022-35938

CVE-2022-35938

tensorflow tensorflow — OOB read in `Gather_nd` op in TensorFlow Lite Micro

EPSS 0.6%CVSS 9.1
critical.is priorityof 100
37
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 47.2.472 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. This issue has been patched in GitHub commit 4142e47e9e31db481781b955ed3ff807a781b494. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Affected

ProductAffectedFixed inSource
tensorflow< 2.7.2–CNA
tensorflow>= 2.8.0, < 2.8.1–CNA
tensorflow>= 2.9.0, < 2.9.1–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
GitHub_M (CNA)7.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/tensorflow/tensorflow/security/advisories/GHSA-3m3g-pf5v-5hpjrefgithub.com/tensorflow/tflite-micro/commit/4142e47e9e31db481781b955ed3ff807a781b494refgithub.com/tensorflow/tflite-micro/blob/1bc98621180a350eb4e8d3318ea8e228c7559b37/tensorflow/lite/micro/kernels/gather_nd.cc#L143-L154