---

CVE-2021-37645 - log back

CVE-2021-37645 created at 13 Aug 2021 07:58:01
Severity	+ Medium
Remote	+ Local
Type	+ Incorrect calculation
Description	+ In TensorFlow before version 2.6.0 the implementation of tf.raw_ops.QuantizeAndDequantizeV4Grad is vulnerable to an integer overflow issue caused by converting a signed integer value to an unsigned one and then allocating memory based on this value. The implementation uses the axis value as the size argument to absl::InlinedVector constructor. But, the constructor uses an unsigned type for the argument, so the implicit conversion transforms the negative value to a large integer.
References	+ https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9w2p-5mgw-p94c + https://github.com/tensorflow/tensorflow/commit/96f364a1ca3009f98980021c4b32be5fdcca33a1
Notes