CVE-2022-21741

一、漏洞信息
 漏洞编号：[CVE-2022-21741](https://nvd.nist.gov/vuln/detail/CVE-2022-21741)
 漏洞归属组件：TensorFlow
 漏洞归属的版本：1.15.2
 CVSS V3.0分值：
  BaseScore：6.5 Medium
  Vector：CVSS：3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 漏洞简述：
  Tensorflow is an Open Source Machine Learning Framework. ### Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions. The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added before applying the convolution. There is no check before this division that the divisor is strictly positive. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
 漏洞公开时间：2022-02-03 23:15
 漏洞创建时间：2022-02-09 19:29:49
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-21741
 漏洞分析指导链接：
  https://gitee.com/mindspore/community/blob/master/security/cve_issue_template.md
二、漏洞分析结构反馈
 影响性分析说明：
  迁移工具（mindconverter）转换tensorflow模型时，先把tensorflow模型转换成onnx模型，再把onnx模型转换成mindspore模型。经分析，此CVE只对tensorflow模型生效，且在tensorflow转onnx过程中无提权、注入等高危影响，因此对迁移工具（mindconverter）无安全风险
 MindSpore评分：
  6.5
 Vector：CVSS：3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master:不受影响
2.v1.3.0:不受影响
3.v1.5.0:不受影响
4.v1.5.0-rc1:不受影响
5.v1.6.0:不受影响

GVP MindSpore/mindinsight
暂停

内容风险标识

评论 (4)

GVPMindSpore/mindinsight暂停

内容风险标识

CVE-2022-21741

评论 (4)

搜索帮助

GVP MindSpore/mindinsight
暂停