PT-2022-16079 · Google · Tensorflow

Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23563

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.0 through 2.7.0 (will be patched in 2.7.1) TensorFlow versions 2.6.0 through 2.6.2 (will be patched in 2.6.3) TensorFlow versions 2.5.0 through 2.5.2 (will be patched in 2.5.3)

Description The issue arises from TensorFlow's use of tempfile.mktemp to create temporary files, which can be dangerous in utilities and libraries as a different process can create the file between the check for the filename in mktemp and the actual creation of the file by a subsequent operation, resulting in a TOC/TOU type of weakness. In several instances, TensorFlow was supposed to create a temporary directory instead of a file, but this logic bug is hidden away by the mktemp function usage.

Recommendations For TensorFlow versions prior to 2.8.0, upgrade to version 2.8.0 or later as soon as possible. For TensorFlow versions 2.7.0 through 2.7.0, upgrade to version 2.7.1 or later. For TensorFlow versions 2.6.0 through 2.6.2, upgrade to version 2.6.3 or later. For TensorFlow versions 2.5.0 through 2.5.2, upgrade to version 2.5.3 or later. As a temporary workaround, consider replacing tempfile.mktemp with the safer mkstemp/mkdtemp functions, according to the usage pattern, until a patch is available.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Time Of Check To Time Of Use

Weakness Enumeration

CWE-668

CWE-367

Related Identifiers

BIT-TENSORFLOW-2022-23563

CVE-2022-23563

GHSA-WC4G-R73W-X8MM

OPENSUSE-SU-2024:12116-1

PYSEC-2022-127

PYSEC-2022-72

Affected Products

Tensorflow

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23563.json · Exploit
• https://osv.dev/vulnerability/PYSEC-2022-127 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-72 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23563 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23563 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23563 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wc4g-r73w-x8mm · Vendor Advisory
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wc4g-r73w-x8mm · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-72.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-127.yaml · Note
• https://t.me/cvenotify/54275 · Telegram Post