CVE-2022-21741

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Tensorflow is an Open Source Machine Learning Framework. ### Impact An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions. The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added before applying the convolution. There is no check before this division that the divisor is strictly positive. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-369

Affected software

No affected versions have been published.

Timeline

Published
Feb 3, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-217426.5Realtek USB driver has a buffer overflow vulnerability due to insufficient parameter length verification in the API function. An unauthenticCVE-2022-217437.8In ion, there is a possible use after free due to an integer overflow. This could lead to local escalation of privilege with no additional eCVE-2022-217449.8In Modem 2G RR, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when decodinCVE-2022-217458.8In WIFI Firmware, there is a possible memory corruption due to a use after free. This could lead to remote escalation of privilege, when devCVE-2022-217464.4In imgsensor, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System eCVE-2022-217474.4In imgsensor, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System eCVE-2022-217485.5In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure CVE-2022-217495.5In telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure CVE-2022-21757.8Buffer Over-read in GitHub repository vim/vim prior to 8.2.CVE-2022-217506.7In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege withCVE-2022-217516.7In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege withCVE-2022-217526.7In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with
CVE-2022-21741: Medium severity, CVSS 6.5 | Vulnix