Skip to main content

Out-of-bounds Write

CVE-2022-35939

High
9.8/10

Summary

TensorFlow is an open source platform for machine learning. The "ScatterNd" function takes an input argument that determines the indices of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. The fix will be included in TensorFlow 2.10.0. This vulnerability was also fixed in TensorFlow 2.9.2, TensorFlow 2.8.3, and TensorFlow 2.7.4, as these are also affected and still in supported range. There are no known workarounds for this issue. The issue was affected prior to 2.7.4, 2.8.x prior to 2.8.3, and 2.9.x prior to 2.9.2.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-787 - Out-of-Bounds Write

Out-of-bounds write vulnerability is a memory access bug that allows software to write data past the end or before the beginning of the intended buffer. This may result in the corruption of data, a crash, or arbitrary code execution.

References

Advisory Timeline

  • Published