PT-2022-15068 · Google · Tensorflow

Yu Tian · Published 2022-02-03 · Updated 2024-03-06 · CVE-2022-21729

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions 2.5.3 through 2.7.1 TensorFlow version 2.8.0 is not affected as it includes the fix.

Description The implementation of UnravelIndex is vulnerable to a division by zero caused by an integer overflow bug. This issue can be exploited using the tf.raw ops.UnravelIndex function with specific parameters, such as indices=-0x100000 and dims=[0x100000,0x100000]. The vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.

Recommendations For TensorFlow versions 2.5.3, 2.6.3, and 2.7.1, update to the respective patched versions to resolve the issue. For TensorFlow versions prior to 2.5.3, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider avoiding the use of the UnravelIndex function with large input values until a patch is available.

Exploit

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-TENSORFLOW-2022-21729

CVE-2022-21729

GHSA-34F9-HJFQ-RR8J

OPENSUSE-SU-2024:12116-1

PYSEC-2022-108

PYSEC-2022-53

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/unravel_index_op.cc#L36-L135 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21729.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-34f9-hjfq-rr8j · Patch
• https://github.com/tensorflow/tensorflow/commit/58b34c6c8250983948b5a781b426f6aa01fd47af · Patch
• https://osv.dev/vulnerability/GHSA-34f9-hjfq-rr8j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-21729 · Security Note
• https://osv.dev/vulnerability/CVE-2022-21729 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-53 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-21729 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-108 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-53.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-108.yaml · Note
• https://t.me/cibsecurity/36767 · Telegram Post