PT-2022-15065 · Google · Tensorflow

Yu Tian · Published 2022-02-03 · Updated 2024-03-06 · CVE-2022-21726

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier

Description The implementation of Dequantize does not fully validate the value of axis and can result in heap OOB accesses. The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions of the input tensor.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later. For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later. For versions 2.5.3 and earlier, update to TensorFlow 2.5.3 or later. As a temporary workaround, consider validating the axis argument to prevent heap OOB accesses.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BIT-TENSORFLOW-2022-21726

CVE-2022-21726

GHSA-23HM-7W47-XW72

OPENSUSE-SU-2024:12116-1

PYSEC-2022-105

PYSEC-2022-50

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/dequantize_op.cc#L92-L153 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21726.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/23968a8bf65b009120c43b5ebcceaf52dbc9e943 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-21726 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-105 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-50 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-21726 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-23hm-7w47-xw72 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21726 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-23hm-7w47-xw72 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-50.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-105.yaml · Note
• https://t.me/cibsecurity/36760 · Telegram Post