PT-2022-16090 · Google · Tensorflow

Mihaimaruseac · Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23573

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.0 through 2.7.0 (will be fixed in 2.7.1) TensorFlow versions 2.6.0 through 2.6.2 (will be fixed in 2.6.3) TensorFlow versions 2.5.0 through 2.5.2 (will be fixed in 2.5.3)

Description The implementation of AssignOp can result in copying uninitialized data to a new tensor, leading to undefined behavior. This occurs because the implementation checks if the left-hand side of the assignment is initialized but does not check the right-hand side.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.0 through 2.7.0, update to TensorFlow 2.7.1. For versions 2.6.0 through 2.6.2, update to TensorFlow 2.6.3. For versions 2.5.0 through 2.5.2, update to TensorFlow 2.5.3.

Exploit

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

BIT-TENSORFLOW-2022-23573

CVE-2022-23573

GHSA-Q85F-69Q7-55H2

OPENSUSE-SU-2024:12116-1

PYSEC-2022-137

PYSEC-2022-82

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/kernels/assign_op.h#L30-L143 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23573.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q85f-69q7-55h2 · Patch
• https://github.com/tensorflow/tensorflow/commit/ef1d027be116f25e25bb94a60da491c2cf55bd0b · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23573 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23573 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23573 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-82 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q85f-69q7-55h2 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-137 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-137.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-82.yaml · Note