PT-2022-16073 · Google · Tensorflow

Wang Xuan · Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23558

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier

Description An attacker can craft a TFLite model that would cause an integer overflow in TfLiteIntArrayCreate. The TfLiteIntArrayGetSizeInBytes returns an int instead of a size t. An attacker can control model inputs such that computed size overflows the size of int datatype.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later. For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later. For versions 2.5.3 and earlier, update to TensorFlow 2.5.3 or later. As a temporary workaround, consider restricting the use of TfLiteIntArrayCreate and TfLiteIntArrayGetSizeInBytes functions until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-TENSORFLOW-2022-23558

CVE-2022-23558

GHSA-9GWQ-6CWJ-47H3

OPENSUSE-SU-2024:12116-1

PYSEC-2022-122

PYSEC-2022-67

Affected Products

Tensorflow

References · 15

• 🔥 https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/c/common.c#L24-L33 · Exploit
• 🔥 https://github.com/tensorflow/tensorflow/blob/ca6f96b62ad84207fbec580404eaa7dd7403a550/tensorflow/lite/c/common.c#L53-L60 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23558.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/a1e1511dde36b3f8aa27a6ec630838e7ea40e091 · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9gwq-6cwj-47h3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23558 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-122 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-67 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9gwq-6cwj-47h3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23558 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23558 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-67.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-122.yaml · Note
• https://t.me/cibsecurity/36903 · Telegram Post