PT-2022-16110 · Google · Tensorflow

Mihaimaruseac · Published 2022-02-04 · Updated 2024-03-06 · CVE-2022-23593

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow version 2.8.0

Description The simplifyBroadcast function in the MLIR-TFRT infrastructure is vulnerable to a segfault, resulting in a denial of service, when called with scalar shapes. If all shapes are scalar, the maxRank is 0, leading to the construction of an empty SmallVector.

Recommendations For TensorFlow version 2.8.0, update to a version that includes the fix, which will be available in the next release. As a temporary workaround, consider avoiding the use of scalar shapes with the simplifyBroadcast function until the patch is applied.

Exploit

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BIT-TENSORFLOW-2022-23593

CVE-2022-23593

GHSA-GWCX-JRX4-92W2

PYSEC-2022-102

PYSEC-2022-157

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/mlir/tfrt/jit/transforms/tf_cpurt_symbolic_shape_optimization.cc#L149-L205 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23593.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/35f0fabb4c178253a964d7aabdbb15c6a398b69a · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gwcx-jrx4-92w2 · Patch
• https://osv.dev/vulnerability/GHSA-gwcx-jrx4-92w2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23593 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-23593 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23593 · Security Note
• https://osv.dev/vulnerability/PYSEC-2022-157 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-157.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-102.yaml · Note