PT-2022-23045 · Google · Tensorflow

Hui Peng · Published 2022-09-16 · Updated 2024-03-06 · CVE-2022-35939

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier

Description The ScatterNd function in TensorFlow takes an input argument that determines the indices of the output tensor. If the input index is greater than the output tensor or less than zero, it can either write content at the wrong index or trigger a crash.

Recommendations For versions prior to 2.10.0, update to TensorFlow 2.10.0 or later. For versions 2.9.1 and earlier, update to TensorFlow 2.9.1 or later. For versions 2.8.1 and earlier, update to TensorFlow 2.8.1 or later. For versions 2.7.2 and earlier, update to TensorFlow 2.7.2 or later. As a temporary workaround, consider restricting the use of the ScatterNd function until a patch is available.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BIT-TENSORFLOW-2022-35939

CVE-2022-35939

GHSA-FFJM-4QWC-7CMF

OPENSUSE-SU-2024:12355-1

Affected Products

Tensorflow

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35939.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/b4d4b4cb019bd7240a52daa4ba61e3cc814f0384 · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-ffjm-4qwc-7cmf · Patch
• https://osv.dev/vulnerability/GHSA-ffjm-4qwc-7cmf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-35939 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-35939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35939 · Security Note
• https://github.com/tensorflow/tensorflow/blob/266558ac4c1f361e9a178ee9d3f0ce2e648ae499/tensorflow/lite/kernels/internal/reference/reference_ops.h#L659-L698 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0 · Note
• https://github.com/tensorflow/tensorflow · Note