PT-2022-26122 · Google · Tensorflow

Tong Liu · Published 2022-11-18 · Updated 2024-03-06 · CVE-2022-41891

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1 and earlier TensorFlow versions 2.9.3 and earlier TensorFlow versions 2.8.4 and earlier

Description The issue results in a segmentation fault when tf.raw ops.TensorListConcat is given element shape=[], which can be used to trigger a denial of service attack. This can be achieved by providing an empty element shape to the tf.raw ops.TensorListConcat function, as shown in the example code. The estimated number of potentially affected devices is not specified.

Recommendations For versions prior to 2.11, update to TensorFlow 2.11 or later. For versions 2.10.1 and earlier, update to TensorFlow 2.10.1 or later, or apply the patch from GitHub commit fc33f3dc4c14051a83eec6535b608abe1d355fde. For versions 2.9.3 and earlier, update to TensorFlow 2.9.3 or later, or apply the patch from GitHub commit fc33f3dc4c14051a83eec6535b608abe1d355fde. For versions 2.8.4 and earlier, update to TensorFlow 2.8.4 or later, or apply the patch from GitHub commit fc33f3dc4c14051a83eec6535b608abe1d355fde. As a temporary workaround, consider avoiding the use of tf.raw ops.TensorListConcat with an empty element shape until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

AZL-11530

BIT-TENSORFLOW-2022-41891

CVE-2022-41891

GHSA-66VQ-54FQ-6JVV

Affected Products

Tensorflow

References · 10

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-66vq-54fq-6jvv · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41891.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/fc33f3dc4c14051a83eec6535b608abe1d355fde · Patch
• https://osv.dev/vulnerability/CVE-2022-41891 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41891 · Security Note
• https://osv.dev/vulnerability/AZL-11530 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-41891 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66vq-54fq-6jvv · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.h · Note