PT-2022-23111 · Google · Tensorflow

Pak-Laura · Published 2022-09-16 · Updated 2024-03-06 · CVE-2022-36011

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.10.0 TensorFlow versions 2.9.1 and earlier TensorFlow versions 2.8.1 and earlier TensorFlow versions 2.7.2 and earlier

Description The issue occurs when the mlir::tfg::ConvertGenericFunctionToFunctionDef function is given empty function attributes, resulting in a null dereference. This happens when the namedAttr.first is empty, causing the program to crash. The estimated number of potentially affected devices worldwide is not available.

Recommendations For TensorFlow versions prior to 2.10.0, update to version 2.10.0 or later. For TensorFlow versions 2.9.1 and earlier, update to version 2.9.1 or later, or apply the patch from GitHub commit 1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b. For TensorFlow versions 2.8.1 and earlier, update to version 2.8.1 or later, or apply the patch from GitHub commit 1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b. For TensorFlow versions 2.7.2 and earlier, update to version 2.7.2 or later, or apply the patch from GitHub commit 1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b. As a temporary workaround, consider adding a check to ensure that namedAttr.first is not empty before processing it.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2022-36011

CVE-2022-36011

GHSA-FV43-93GV-VM8F

OPENSUSE-SU-2024:12355-1

Affected Products

Tensorflow

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36011.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/1cf45b831eeb0cab8655c9c7c5d06ec6f45fc41b · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2022-36011 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fv43-93gv-vm8f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36011 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36011 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/releases/tag/v2.10.0 · Note
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-fv43-93gv-vm8f · Note
• https://github.com/tensorflow/tensorflow · Note