PT-2022-16099 · Google · Tensorflow
Mihaimaruseac
·
Published
2022-02-04
·
Updated
2024-03-06
·
CVE-2022-23582
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
TensorFlow versions prior to 2.8.0
TensorFlow versions 2.7.1 and earlier
TensorFlow versions 2.6.3 and earlier
TensorFlow versions 2.5.3 and earlier
Description
A malicious user can cause a denial of service by altering a
SavedModel such that TensorByteSize would trigger CHECK failures. The TensorShape constructor throws a CHECK-fail if the shape is partial or has a number of elements that would overflow the size of an int. The PartialTensorShape constructor instead does not cause a CHECK-abort if the shape is partial, which is exactly what this function needs to be able to return -1.Recommendations
For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later.
For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later.
For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later.
For versions 2.5.3 and earlier, update to TensorFlow 2.5.3 or later.
As a temporary workaround, consider restricting the use of the
TensorByteSize function until a patch is available.
Avoid using the TensorShape constructor with partial shapes until the issue is resolved.Exploit
Fix
Assertion Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tensorflow