PT-2022-26124 · Google · Tensorflow

Pattarakrit Rattankul · Published 2022-11-18 · Updated 2024-03-06 · CVE-2022-41893

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4

Description TensorFlow is an open source platform for machine learning. If tf.raw ops.TensorListResize is given a nonscalar value for input size, it results in a CHECK fail which can be used to trigger a denial of service attack.

Recommendations For TensorFlow versions prior to 2.11, update to version 2.11 or later. For TensorFlow version 2.10.1, update to a version that includes the patch from GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. For TensorFlow version 2.9.3, update to a version that includes the patch from GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. For TensorFlow version 2.8.4, update to a version that includes the patch from GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. As a temporary workaround, consider avoiding the use of tf.raw ops.TensorListResize with nonscalar values for input size until a patch is applied.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

AZL-11531

BIT-TENSORFLOW-2022-41893

CVE-2022-41893

GHSA-67PF-62XR-Q35M

Affected Products

Tensorflow

References · 11

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-67pf-62xr-q35m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41893.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/888e34b49009a4e734c27ab0c43b0b5102682c56 · Patch
• https://osv.dev/vulnerability/AZL-11531 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67pf-62xr-q35m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41893 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2022-41893 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41893 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.cc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/53179 · Telegram Post