CVE-2022-21737

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier

Description The implementation of *Bincount operations in TensorFlow allows malicious users to cause denial of service by passing in arguments that trigger a CHECK-fail. There are several conditions that the input arguments must satisfy, some of which are not caught during shape inference and others during kernel implementation, resulting in CHECK failures when output tensors are allocated.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later. For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later. For versions 2.5.3 and earlier, update to TensorFlow 2.5.3 or later. As a temporary workaround, consider restricting the use of *Bincount operations until a patch is available.