PT-2022-16081 · Google · Tensorflow

Mihaimaruseac · Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23565

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1, 2.6.3, and 2.5.3 are also affected

Description An attacker can trigger denial of service via assertion failure by altering a SavedModel on disk such that AttrDefs of some operation are duplicated.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.1, 2.6.3, and 2.5.3, update to the respective cherrypicked versions. As a temporary workaround, consider restricting access to SavedModel files to minimize the risk of exploitation.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BIT-TENSORFLOW-2022-23565

CVE-2022-23565

GHSA-4V5P-V5H9-6XJX

OPENSUSE-SU-2024:12116-1

PYSEC-2022-129

PYSEC-2022-74

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23565.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4v5p-v5h9-6xjx · Patch
• https://github.com/tensorflow/tensorflow/commit/c2b31ff2d3151acb230edc3f5b1832d2c713a9e0 · Patch
• https://osv.dev/vulnerability/CVE-2022-23565 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23565 · Security Note
• https://osv.dev/vulnerability/GHSA-4v5p-v5h9-6xjx · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-129 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-74 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-74.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-129.yaml · Note
• https://t.me/cibsecurity/36902 · Telegram Post
• https://t.me/cvenotify/26523 · Telegram Post