PT-2022-16089 · Google · Tensorflow

Mihaimaruseac · Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23572

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier

Description TensorFlow can fail to specialize a type during shape inference. This issue is covered by the DCHECK function, which is a no-op in production builds and an assertion failure in debug builds. As a result, execution proceeds to the ValueOrDie line, causing an assertion failure because ret contains an error Status, not a value. In debug builds, this also results in a crash due to the assertion failure.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later. For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later.

Exploit

Fix

Improper Check for Exceptional Conditions

Assertion Failure

Weakness Enumeration

CWE-754

CWE-617

Related Identifiers

BIT-TENSORFLOW-2022-23572

CVE-2022-23572

GHSA-RWW7-2GPW-FV6J

OPENSUSE-SU-2024:12116-1

PYSEC-2022-136

PYSEC-2022-81

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L168-L174 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23572.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rww7-2gpw-fv6j · Patch
• https://github.com/tensorflow/tensorflow/commit/cb164786dc891ea11d3a900e90367c339305dc7b · Patch
• https://osv.dev/vulnerability/CVE-2022-23572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23572 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-136 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rww7-2gpw-fv6j · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23572 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-81 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-136.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-81.yaml · Note
• https://t.me/cvenotify/54274 · Telegram Post