PT-2022-16085 · Google · Tensorflow

Faysal Hossain Shezan · Published 2022-02-03 · Updated 2024-03-06 · CVE-2022-23569

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1, 2.6.3, and 2.5.3 are also affected

Description Multiple operations in TensorFlow can be used to trigger a denial of service via CHECK-fails (i.e., assertion failures). This issue is similar to previous instances and has similar fixes. The reported issues have been patched in multiple GitHub commits. It is possible that other similar instances exist in TensorFlow, and fixes will be issued as these are discovered.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 to resolve the issue. For version 2.7.1, update to a newer version that includes the cherrypicked commit. For version 2.6.3, update to a newer version that includes the cherrypicked commit. For version 2.5.3, update to a newer version that includes the cherrypicked commit. As a temporary workaround, consider disabling the CHECK-fails (i.e., assertion failures) until a patch is available.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BIT-TENSORFLOW-2022-23569

CVE-2022-23569

GHSA-QJ5R-F9MV-RFFH

OPENSUSE-SU-2024:12116-1

PYSEC-2022-133

PYSEC-2022-78

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23569.json · Exploit
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qj5r-f9mv-rffh · Patch
• https://osv.dev/vulnerability/PYSEC-2022-133 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23569 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-78 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qj5r-f9mv-rffh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23569 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-78.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-133.yaml · Note
• https://t.me/cibsecurity/36769 · Telegram Post