PT-2022-16094 · Google · Tensorflow

Mihaimaruseac · Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23577

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1, 2.6.3, and 2.5.3 are also affected

Description The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer. This issue can be exploited by a malicious user altering the SavedModel protobuf format on disk before loading, causing the second .find to return nullptr.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For version 2.7.1, update to a version that includes the cherrypicked commit. For version 2.6.3, update to a version that includes the cherrypicked commit. For version 2.5.3, update to a version that includes the cherrypicked commit. As a temporary workaround, consider restricting access to the GetInitOp implementation until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2022-23577

CVE-2022-23577

GHSA-8CXV-76P7-JXWR

OPENSUSE-SU-2024:12116-1

PYSEC-2022-141

PYSEC-2022-86

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/cc/saved_model/loader_util.cc#L31-L61 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23577.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/4f38b1ac8e42727e18a2f0bde06d3bee8e77b250 · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8cxv-76p7-jxwr · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23577 · Security Note
• https://osv.dev/vulnerability/GHSA-8cxv-76p7-jxwr · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-86 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23577 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-141 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23577 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-141.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-86.yaml · Note
• https://t.me/cibsecurity/36891 · Telegram Post