{"containers": {"cna": {"affected": [{"product": "tensorflow", "vendor": "tensorflow", "versions": [{"status": "affected", "version": "< 2.6.4"}, {"status": "affected", "version": ">= 2.7.0rc0, < 2.7.2"}, {"status": "affected", "version": ">= 2.8.0rc0, < 2.8.1"}, {"status": "affected", "version": ">= 2.9.0rc0, < 2.9.0"}]}], "descriptions": [{"lang": "en", "value": "TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.EditDistance` has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service. In multiple places throughout the code, one may compute an index for a write operation. However, the existing validation only checks against the upper bound of the array. Hence, it is possible to write before the array by massaging the input to generate negative values for `loc`. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-20T22:30:13", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-2r2f-g8mw-9gvr"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/tensorflow/tensorflow/commit/30721cf564cb029d34535446d6a5a6357bebc8e7"}], "source": {"advisory": "GHSA-2r2f-g8mw-9gvr", "discovery": "UNKNOWN"}, "title": "Segfault and Out-of-bounds Write write due to incomplete validation in TensorFlow", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-29208", "STATE": "PUBLIC", "TITLE": "Segfault and Out-of-bounds Write write due to incomplete validation in TensorFlow"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "tensorflow", "version": {"version_data": [{"version_value": "< 2.6.4"}, {"version_value": ">= 2.7.0rc0, < 2.7.2"}, {"version_value": ">= 2.8.0rc0, < 2.8.1"}, {"version_value": ">= 2.9.0rc0, < 2.9.0"}]}}]}, "vendor_name": "tensorflow"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.EditDistance` has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service. In multiple places throughout the code, one may compute an index for a write operation. However, the existing validation only checks against the upper bound of the array. Hence, it is possible to write before the array by massaging the input to generate negative values for `loc`. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-787: Out-of-bounds Write"}]}]}, "references": {"reference_data": [{"name": "https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4", "refsource": "MISC", "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4"}, {"name": "https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2", "refsource": "MISC", "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2"}, {"name": "https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1", "refsource": "MISC", "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1"}, {"name": "https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0", "refsource": "MISC", "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0"}, {"name": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-2r2f-g8mw-9gvr", "refsource": "CONFIRM", "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-2r2f-g8mw-9gvr"}, {"name": "https://github.com/tensorflow/tensorflow/commit/30721cf564cb029d34535446d6a5a6357bebc8e7", "refsource": "MISC", "url": "https://github.com/tensorflow/tensorflow/commit/30721cf564cb029d34535446d6a5a6357bebc8e7"}]}, "source": {"advisory": "GHSA-2r2f-g8mw-9gvr", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-29208", "datePublished": "2022-05-20T22:30:13", "dateReserved": "2022-04-13T00:00:00", "dateUpdated": "2022-05-20T22:30:13", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*", "matchCriteriaId": "D9359D32-D090-44CF-AC43-2046084A28BB", "versionEndExcluding": "2.6.4", "vulnerable": true}, {"criteria": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4DFBF2D-5283-42F6-8800-D653BFA5CE82", "versionEndExcluding": "2.7.2", "versionStartIncluding": "2.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*", "matchCriteriaId": "A58EDA5C-66D6-46F1-962E-60AFB7C784A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "89522760-C2DF-400D-9624-626D8F160CBA", "vulnerable": true}, {"criteria": "cpe:2.3:a:google:tensorflow:2.8.0:-:*:*:*:*:*:*", "matchCriteriaId": "E9EA1898-ACAA-4699-8BAE-54D62C1819FB", "vulnerable": true}, {"criteria": "cpe:2.3:a:google:tensorflow:2.8.0:rc0:*:*:*:*:*:*", "matchCriteriaId": "130DE3C9-6842-456F-A259-BF8FF8457217", "vulnerable": true}, {"criteria": "cpe:2.3:a:google:tensorflow:2.8.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "BBF2FCEF-989C-409D-9F4C-81418C65B972", "vulnerable": true}, {"criteria": "cpe:2.3:a:google:tensorflow:2.9.0:rc0:*:*:*:*:*:*", "matchCriteriaId": "9CFB1CFC-579D-4647-A472-6DE8BE1951DE", "vulnerable": true}, {"criteria": "cpe:2.3:a:google:tensorflow:2.9.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F3F3F37E-D27F-4060-830C-0AFF16150777", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.EditDistance` has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service. In multiple places throughout the code, one may compute an index for a write operation. However, the existing validation only checks against the upper bound of the array. Hence, it is possible to write before the array by massaging the input to generate negative values for `loc`. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue."}, {"lang": "es", "value": "TensorFlow es una plataforma de c\u00f3digo abierto para el aprendizaje autom\u00e1tico. En versiones anteriores a 2.9.0, 2.8.1, 2.7.2 y 2.6.4, la implementaci\u00f3n de \"tf.raw_ops.EditDistance\" presenta una comprobaci\u00f3n incompleta. Los usuarios pueden pasar valores negativos para causar una denegaci\u00f3n de servicio basada en un fallo de segmentaci\u00f3n. En m\u00faltiples lugares a lo largo del c\u00f3digo, puede calcularse un \u00edndice para una operaci\u00f3n de escritura. Sin embargo, la comprobaci\u00f3n existente s\u00f3lo comprueba el l\u00edmite superior del array. Por lo tanto, es posible escribir antes de la matriz al masajear la entrada para generar valores negativos para \"loc\". Las versiones 2.9.0, 2.8.1, 2.7.2 y 2.6.4 contienen un parche para este problema"}], "id": "CVE-2022-29208", "lastModified": "2022-06-03T02:02:54.007", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 3.6, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2022-05-20T23:15:45.150", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/tensorflow/tensorflow/commit/30721cf564cb029d34535446d6a5a6357bebc8e7"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1"}, {"source": "security-advisories@github.com", "tags": ["Release Notes", "Third Party Advisory"], "url": "https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/tensorflow/tensorflow/security/advisories/GHSA-2r2f-g8mw-9gvr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Primary"}]}

{}