AVID-2026-R0954

Description

Heap overflow in Tensorflow (CVE-2022-21740)

Details

Tensorflow is an Open Source Machine Learning Framework. The implementation of SparseCountSparseOutput is vulnerable to a heap overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Reason for inclusion in AVID: CVE-2022-21740 describes a heap overflow in TensorFlow’s SparseCountSparseOutput, a vulnerability in a widely used AI framework. TensorFlow is a software component used to build, train, deploy, and run general-purpose AI systems, so this is a software supply-chain-relevant issue within AI stacks. The CVE entry includes impact details, affected versions, and references (advisories, commits, and code location), indicating a security vulnerability with potential RCE/impact characteristics as per CVSS data provided.

References

Affected or Relevant Artifacts

Developer: n/a
Deployer: n/a
Artifact Details:

Type	Name
System	n/a

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Base Score	7.6
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🟢 Low
Integrity Impact	🟢 Low
Availability Impact	🔴 High

Other information

Report Type: Advisory
Credits:
Date Reported: 2022-02-03
Version: 0.3.3
AVID Entry