PT-2022-16095 · Google · Tensorflow

Mihaimaruseac · Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23578

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier

Description The issue arises when a graph node is invalid, causing TensorFlow to leak memory in the implementation of ImmutableExecutorState::Initialize. This occurs because item->kernel is set to nullptr, but it is a simple OpKernel* pointer, resulting in a memory leak of previously allocated memory.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later to resolve the issue. For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later to resolve the issue. For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later to resolve the issue. For versions 2.5.3 and earlier, update to TensorFlow 2.5.3 or later to resolve the issue.

Exploit

Fix

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BIT-TENSORFLOW-2022-23578

CVE-2022-23578

GHSA-8R7C-3CM2-3H8F

OPENSUSE-SU-2024:12116-1

PYSEC-2022-142

PYSEC-2022-87

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/common_runtime/immutable_executor_state.cc#L84-L262 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23578.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/c79ccba517dbb1a0ccb9b01ee3bd2a63748b60dd · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8r7c-3cm2-3h8f · Patch
• https://osv.dev/vulnerability/PYSEC-2022-142 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-87 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23578 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23578 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23578 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8r7c-3cm2-3h8f · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-87.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-142.yaml · Note