PT-2022-16083 · Google · Tensorflow

Faysal Hossain Shezan · Published 2022-02-03 · Updated 2024-03-06 · CVE-2022-23567

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier

Description The implementations of Sparse*Cwise* ops in TensorFlow are vulnerable to integer overflows. These can be used to trigger large allocations, resulting in OOM-based denial of service, or CHECK-fails when building new TensorShape objects, leading to assert failures-based denial of service. The issue arises from missing validation on the shapes of the input tensors and directly constructing a large TensorShape with user-provided dimensions.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later. For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later. For versions 2.5.3 and earlier, update to TensorFlow 2.5.3 or later. As a temporary workaround, consider disabling the Sparse*Cwise* ops until a patch is available. Restrict access to the TensorShape constructor to minimize the risk of exploitation. Avoid using user-provided dimensions when constructing a TensorShape object until the issue is resolved.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-TENSORFLOW-2022-23567

CVE-2022-23567

GHSA-RRX2-R989-2C43

OPENSUSE-SU-2024:12116-1

PYSEC-2022-131

PYSEC-2022-76

Affected Products

Tensorflow

References · 18

• 🔥 https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23567.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/1b54cadd19391b60b6fcccd8d076426f7221d5e8 · Patch
• https://github.com/tensorflow/tensorflow/commit/e952a89b7026b98fe8cbe626514a93ed68b7c510 · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rrx2-r989-2c43 · Patch
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md · Patch
• https://osv.dev/vulnerability/GHSA-rrx2-r989-2c43 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23567 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-76 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23567 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-131 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-76.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-131.yaml · Note