PT-2022-15072 · Google · Tensorflow

Yu Tian · Published 2022-02-03 · Updated 2024-03-06 · CVE-2022-21732

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1, 2.6.3, and 2.5.3 are also affected

Description The implementation of ThreadPoolHandle can be used to trigger a denial of service attack by allocating too much memory. This is because the num threads argument is only checked to not be negative, but there is no upper bound on its value.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later to resolve the issue. For version 2.7.1, update to a version that includes the cherrypicked commit. For version 2.6.3, update to a version that includes the cherrypicked commit. For version 2.5.3, update to a version that includes the cherrypicked commit. As a temporary workaround, consider restricting the value of the num threads argument to prevent excessive memory allocation.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BIT-TENSORFLOW-2022-21732

CVE-2022-21732

GHSA-C582-C96P-R5CQ

OPENSUSE-SU-2024:12116-1

PYSEC-2022-111

PYSEC-2022-56

Affected Products

Tensorflow

References · 15

• 🔥 https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/data/experimental/threadpool_dataset_op.cc#L79-L135 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21732.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c582-c96p-r5cq · Patch
• https://github.com/tensorflow/tensorflow/commit/e3749a6d5d1e8d11806d4a2e9cc3123d1a90b75e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-21732 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-56 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c582-c96p-r5cq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-21732 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-111 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-21732 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-56.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-111.yaml · Note
• https://t.me/cibsecurity/36763 · Telegram Post
• https://t.me/cvenotify/26212 · Telegram Post