PT-2022-16093 · Google · Tensorflow

Mihaimaruseac · Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23576

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier

Description The implementation of OpLevelCostEstimator::CalculateOutputSize is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. This can occur when there is a large enough number of dimensions in output shape.dim() or a small number of dimensions being large enough to cause an overflow in the multiplication.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later. For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later. For versions 2.5.3 and earlier, update to TensorFlow 2.5.3 or later. As a temporary workaround, consider restricting the number of dimensions in output shape.dim() to prevent integer overflow until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-TENSORFLOW-2022-23576

CVE-2022-23576

GHSA-WM93-F238-7V37

OPENSUSE-SU-2024:12116-1

PYSEC-2022-140

PYSEC-2022-85

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L1598-L1617 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23576.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/b9bd6cfd1c50e6807846af9a86f9b83cafc9c8ae · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wm93-f238-7v37 · Patch
• https://osv.dev/vulnerability/PYSEC-2022-140 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23576 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23576 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23576 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-85 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wm93-f238-7v37 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-140.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-85.yaml · Note