PT-2022-16077 · Google · Tensorflow

Wang Xuan · Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23561

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions prior to 2.7.1 TensorFlow versions prior to 2.6.3 TensorFlow versions prior to 2.5.3

Description An attacker can craft a TFLite model to cause a write outside the bounds of an array in TFLite, potentially overriding the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions prior to 2.7.1, update to TensorFlow 2.7.1 or later. For versions prior to 2.6.3, update to TensorFlow 2.6.3 or later. For versions prior to 2.5.3, update to TensorFlow 2.5.3 or later.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BIT-TENSORFLOW-2022-23561

CVE-2022-23561

GHSA-9C78-VCQ7-7VXQ

OPENSUSE-SU-2024:12116-1

PYSEC-2022-125

PYSEC-2022-70

Affected Products

Tensorflow

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23561.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/6c0b2b70eeee588591680f5b7d5d38175fd7cdf6 · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9c78-vcq7-7vxq · Patch
• https://osv.dev/vulnerability/CVE-2022-23561 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-70 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23561 · Security Note
• https://osv.dev/vulnerability/GHSA-9c78-vcq7-7vxq · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23561 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-125.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-70.yaml · Note