CVE-2018-7575: Integer Overflow
Issue Description Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability. The type of exploitation is context-dependent. The block size in meta file might contain a large int64 value which causes an integer overflow upon addition. Subsequent code using n as index may cause an out-of-bounds read.
Impact A maliciously crafted meta checkpoint could be used to cause the TensorFlow process to perform an out of bounds read on in process memory.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7575?
CVE-2018-7575 is classified as a high severity vulnerability due to its buffer overflow exploits.
How do I fix CVE-2018-7575?
To mitigate CVE-2018-7575, upgrade TensorFlow to version 1.7.1 or later.
What versions of TensorFlow are affected by CVE-2018-7575?
TensorFlow versions up to and including 1.7.0 are affected by CVE-2018-7575.
What type of exploitation does CVE-2018-7575 involve?
CVE-2018-7575 involves a context-dependent buffer overflow exploitation that arises from an integer overflow.
Is CVE-2018-7575 related to TensorFlow-GPU?
Yes, CVE-2018-7575 affects both TensorFlow and TensorFlow-GPU versions 1.7.x and earlier.