CVE-2022-21739
Summary
| CVE | CVE-2022-21739 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-02-03 14:15:00 UTC |
| Updated | 2022-02-09 05:23:00 UTC |
| Description | Tensorflow is an Open Source Machine Learning Framework. The implementation of `QuantizedMaxPool` has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. |
Risk And Classification
Problem Types: CWE-476
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Tensorflow | 2.7.0 | All | All | All | |
| Application | Tensorflow | All | All | All | All | |
| Application | Tensorflow | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Reference binding to null pointer in `QuantizedMaxPool` · Advisory · tensorflow/tensorflow · GitHub | CONFIRM | github.com | |
| tensorflow/quantized_pooling_ops.cc at 5100e359aef5c8021f2e71c7b986420b85ce7b3d · tensorflow/tensorflow · GitHub | MISC | github.com | |
| Fix nullptr exception in QuantizedMaxPool op when empty list is sent … · tensorflow/tensorflow@53b0dd6 · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.