CVE-2022-21728

描述

Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ReverseSequence` does not fully validate the value of `batch_dim` and can result in a heap OOB read. There is a check to make sure the value of `batch_dim` does not go over the rank of the input, but there is no check for negative values. Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of the array), however if the value is too negative then the implementation of `Dim` would access elements before the start of an array. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

如何修補 CVE-2022-21728

要修補 CVE-2022-21728,請將受影響套件升級到下列已修補版本。

• —升級至 2.5.3 或更新版本
• —升級至 2.5.3 或更新版本
• —升級至 2.5.3 或更新版本
• —升級至 2.5.3 或更新版本
• —升級至 37c01fb5e25c3d80213060460196406c43d31995 或更新版本
• —升級至 2.5.3 或更新版本
• —升級至 37c01fb5e25c3d80213060460196406c43d31995 或更新版本

CVE-2022-21728 正在被利用嗎?

低 — EPSS 為 1.1%,目前沒有觀察到大規模利用活動。

受影響套件(7)

• from 0, < 2.5.3, >= 2.6.0, < 2.6.3, >= 2.7.0, < 2.7.1
• from 0, < 2.5.3
• from 0, < 2.5.3, >= 2.6.0, < 2.6.3, >= 2.7.0, < 2.7.1
• from 0, < 2.5.3
• from 0, < 37c01fb5e25c3d80213060460196406c43d31995 | from 0, < 2.5.3, >= 2.6.0, < 2.6.3
• from 0, < 2.5.3
• from 0, < 37c01fb5e25c3d80213060460196406c43d31995 | from 0, < 2.5.3, >= 2.6.0, < 2.6.3

CVSS 分數

參考連結(10)

• ADVISORYgithub.com/advisories/GHSA-6gmv-pjp9-p8w8
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2022-21728
• PATCHpypi.org/project/tensorflow
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-52.yaml