Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ReverseSequence` does not fully validate the value of `batch_dim` and can result in a heap OOB read. There is a check to make sure the value of `batch_dim` does not go over the rank of the input, but there is no check for negative values. Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of the array), however if the value is too negative then the implementation of `Dim` would access elements before the start of an array. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Published 2022-02-03 11:15:08
Updated 2022-02-08 20:22:22
Source GitHub, Inc.
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2022-21728

0.52%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 76 %
Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-21728

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
5.5
MEDIUM AV:N/AC:L/Au:S/C:P/I:N/A:P
8.0
4.9
NIST
8.1
HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
2.8
5.2
NIST
8.1
HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
2.8
5.2
GitHub, Inc.

CWE ids for CVE-2022-21728

  • The product reads data past the end, or before the beginning, of the intended buffer.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2022-21728

Products affected by CVE-2022-21728

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!