PT-2022-23046 · Google · Tensorflow

Jingyi Shi · Published 2022-09-16 · Updated 2024-03-06 · CVE-2022-35940

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1, 2.8.1, and 2.7.2

Description The RaggedRangOp function takes an argument limits that is eventually used to construct a TensorShape as an int64. If limits is a very large float, it can overflow when converted to an int64. This triggers an InvalidArgument but also throws an abort signal that crashes the program.

Recommendations For TensorFlow versions prior to 2.10.0, update to version 2.10.0 or later. For TensorFlow versions 2.9.1, 2.8.1, and 2.7.2, cherrypick the commit 37cefa91bee4eace55715eeef43720b958a01192 to resolve the issue. As a temporary workaround, consider avoiding the use of very large float values for the limits argument in the RaggedRangOp function until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

BIT-TENSORFLOW-2022-35940

CVE-2022-35940

GHSA-X989-Q2PQ-4Q5X

OPENSUSE-SU-2024:12355-1

Affected Products

Tensorflow

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35940.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-x989-q2pq-4q5x · Patch
• https://github.com/tensorflow/tensorflow/commit/37cefa91bee4eace55715eeef43720b958a01192 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-35940 · Security Note
• https://osv.dev/vulnerability/CVE-2022-35940 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x989-q2pq-4q5x · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-35940 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/0b6b491d21d6a4eb5fbab1cca565bc1e94ca9543/tensorflow/core/kernels/ragged_range_op.cc#L74-L88 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/49991 · Telegram Post