Integer Overflow Affecting tensorflow-cpu package, versions [2.5.0,2.5.1) [,2.4.3)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-TENSORFLOWCPU-1540753
- published 13 Aug 2021
- disclosed 13 Aug 2021
- credit Unknown
Introduced: 13 Aug 2021
CVE-2021-37645 Open this link in a new tabHow to fix?
Upgrade tensorflow-cpu to version 2.5.1, 2.4.3 or higher.
Overview
tensorflow-cpu is a machine learning framework.
Affected versions of this package are vulnerable to Integer Overflow. The implementation of tf.raw_ops.QuantizeAndDequantizeV4Grad is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. The implementation uses the axis value as the size argument to absl::InlinedVector constructor. But, the constructor uses an unsigned type for the argument, so the implicit conversion transforms the negative value to a large integer.