PT-2022-16091 · Google · Tensorflow

Mihaimaruseac · Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23574

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.6.3 TensorFlow versions prior to 2.7.1 TensorFlow versions prior to 2.8.0

Description There is a typo in TensorFlow's SpecializeType which results in heap out-of-bounds read/write. Due to the typo, arg is initialized to the ith mutable argument in a loop where the loop index is j, allowing assignment to arg from outside the vector of arguments. This enables both read and write to outside of bounds data.

Recommendations For versions prior to 2.6.3, update to TensorFlow 2.6.3 or later. For versions prior to 2.7.1, update to TensorFlow 2.7.1 or later. For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later.

Exploit

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

BIT-TENSORFLOW-2022-23574

CVE-2022-23574

GHSA-77GP-3H4R-6428

OPENSUSE-SU-2024:12116-1

PYSEC-2022-138

PYSEC-2022-83

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L81-L102 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23574.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-77gp-3h4r-6428 · Patch
• https://github.com/tensorflow/tensorflow/commit/0657c83d08845cc434175934c642299de2c0f042 · Patch
• https://osv.dev/vulnerability/CVE-2022-23574 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23574 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-138 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-83 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23574 · Security Note
• https://osv.dev/vulnerability/GHSA-77gp-3h4r-6428 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-138.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-83.yaml · Note