PT-2022-15066 · Google · Tensorflow

Yu Tian · Published 2022-02-03 · Updated 2024-03-06 · CVE-2022-21727

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier

Description The implementation of shape inference for Dequantize is vulnerable to an integer overflow weakness. The axis argument can be -1 (the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computes axis + 1, an attacker can trigger an integer overflow.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later. For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later. For versions 2.5.3 and earlier, update to TensorFlow 2.5.3 or later. As a temporary workaround, consider restricting the use of the axis argument in the Dequantize function to prevent integer overflow.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-TENSORFLOW-2022-21727

CVE-2022-21727

GHSA-C6FH-56W7-FVJW

OPENSUSE-SU-2024:12116-1

PYSEC-2022-106

PYSEC-2022-51

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/ops/array_ops.cc#L3001-L3034 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21727.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c6fh-56w7-fvjw · Patch
• https://github.com/tensorflow/tensorflow/commit/b64638ec5ccaa77b7c1eb90958e3d85ce381f91b · Patch
• https://osv.dev/vulnerability/PYSEC-2022-51 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-106 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21727 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2022-21727 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21727 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c6fh-56w7-fvjw · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-51.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-106.yaml · Note
• https://t.me/cibsecurity/36759 · Telegram Post