Update dependency tensorflow to v2 [SECURITY] #24
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==1.15.0
->==2.7.2
GitHub Vulnerability Alerts
CVE-2021-41208
Impact
The code for boosted trees in TensorFlow is still missing validation. As a result, attackers can trigger denial of service (via dereferencing
nullptr
s or viaCHECK
-failures) as well as abuse undefined behavior (binding references tonullptr
s). An attacker can also read and write from heap buffers, depending on the API that gets used and the arguments that are passed to the call.Note: Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. Instead, please use the downstream TensorFlow Decision Forests project which is newer and supports more features. We will deprecate TensorFlow's boosted trees APIs in subsequent releases.
Patches
We have patched the issue in GitHub commit 5c8c9a8bfe750f9743d0c859bae112060b216f5c.
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
CVE-2022-23586
Impact
A malicious user can cause a denial of service by altering a
SavedModel
such that assertions infunction.cc
would be falsified and crash the Python interpreter.Patches
We have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and 3d89911481ba6ebe8c88c1c0b595412121e6c645.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23573
Impact
The implementation of
AssignOp
can result in copying unitialized data to a new tensor. This later results in undefined behavior.The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized.
Patches
We have patched the issue in GitHub commit ef1d027be116f25e25bb94a60da491c2cf55bd0b.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23574
Impact
There is a typo in TensorFlow's
SpecializeType
which results in heap OOB read/write:Due to a typo,
arg
is initialized to thei
th mutable argument in a loop where the loop index isj
. Hence it is possible to assign toarg
from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data.Patches
We have patched the issue in GitHub commit 0657c83d08845cc434175934c642299de2c0f042.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23585
Impact
When decoding PNG images TensorFlow can produce a memory leak if the image is invalid.
After calling
png::CommonInitDecode(..., &decode)
, thedecode
value contains allocated buffers which can only be freed by callingpng::CommonFreeDecode(&decode)
. However, several error case in the function implementation invoke theOP_REQUIRES
macro which immediately terminates the execution of the function, without allowing for the memory free to occur.Patches
We have patched the issue in GitHub commit ab51e5b813573dc9f51efa335aebcf2994125ee9.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23587
Impact
Under certain scenarios, Grappler component of TensorFlow is vulnerable to an integer overflow during cost estimation for crop and resize. Since the cropping parameters are user controlled, a malicious person can trigger undefined behavior.
Patches
We have patched the issue in GitHub commit 0aaaae6eca5a7175a193696383f582f53adab23f.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23572
Impact
Under certain scenarios, TensorFlow can fail to specialize a type during shape inference:
However,
DCHECK
is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to theValueOrDie
line. This results in an assertion failure asret
contains an errorStatus
, not a value. In the second case we also get a crash due to the assertion failure.Patches
We have patched the issue in GitHub commit cb164786dc891ea11d3a900e90367c339305dc7b.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23571
Impact
When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a
CHECK
assertion is invalidated based on user controlled arguments, if the tensors have an invaliddtype
and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow processes.Patches
We have patched the issue in GitHub commit 5b491cd5e41ad63735161cec9c2a568172c8b6a3.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23588
Impact
A malicious user can cause a denial of service by altering a
SavedModel
such that Grappler optimizer would attempt to build a tensor using a referencedtype
. This would result in a crash due to aCHECK
-fail in theTensor
constructor as reference types are not allowed.Patches
We have patched the issue in GitHub commit 6b5adc0877de832b2a7c189532dbbbc64622eeb6.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23591
Impact
The
GraphDef
format in TensorFlow does not allow self recursive functions. The runtime assumes that this invariant is satisfied. However, aGraphDef
containing a fragment such as the following can be consumed when loading aSavedModel
:This would result in a stack overflow during execution as resolving each
NodeDef
means resolving the function itself and its nodes.Patches
We have patched the issue in GitHub commit 448a16182065bd08a202d9057dd8ca541e67996c.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23589
Impact
Under certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur, for the same malicious alteration of a
SavedModel
file (fixing the first one would trigger the same dereference in the second place):First, during constant folding, the
GraphDef
might not have the required nodes for the binary operation:If a node is missing, the correposning
mul_*child
would be null, and the dereference in the subsequent line would be incorrect.We have a similar issue during
IsIdentityConsumingSwitch
:NodeDef* input_node = graph.GetNode(tensor_id.node()); return IsSwitch(*input_node);
Patches
We have patched the issue in GitHub commits 0a365c029e437be0349c31f8d4c9926b69fa3fa1 and 045deec1cbdebb27d817008ad5df94d96a08b1bf.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23595
Impact
When building an XLA compilation cache, if default settings are used, TensorFlow triggers a null pointer dereference:
string allowed_gpus = flr->config_proto()->gpu_options().visible_device_list();
In the default scenario, all devices are allowed, so
flr->config_proto
isnullptr
.Patches
We have patched the issue in GitHub commit e21af685e1828f7ca65038307df5cc06de4479e8.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
GHSA-wcv5-vrvr-3rx2
Impact
The Grappler component of TensorFlow is vulnerable to a denial of service via
CHECK
-failure (assertion failure) in constant folding:The
output_prop
tensor has a shape that is controlled by user input and this can result in triggering one of theCHECK
s in thePartialTensorShape
constructor. This is an instance of TFSA-2021-198 (CVE-2021-41197).Patches
We have patched the issue in GitHub commit be7b286d40bc68cb0b56f702186cc4837d508058.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23570
Impact
When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a
DCHECK
:However,
DCHECK
is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the dereferencing of the null pointer, whereas in the second case it results in a crash due to the assertion failure.Patches
We have patched the issue in GitHub commit 8a513cec4bec15961fbfdedcaa5376522980455c.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
GHSA-h6gw-r52c-724r
Impact
The code for boosted trees in TensorFlow is still missing validation. This allows malicious users to read and write outside of bounds of heap allocated data as well as trigger denial of service (via dereferencing
nullptr
s or viaCHECK
-failures).This follows after CVE-2021-41208 where these APIs were still vulnerable to multiple security issues.
Note: Given that the boosted trees implementation in TensorFlow is unmaintained, it is recommend to no longer use these APIs. Instead, please use the downstream TensorFlow Decision Forests project which is newer and supports more features.
These APIs are now deprecated in TensorFlow 2.8. We will remove TensorFlow's boosted trees APIs in subsequent releases.
Patches
We have patched the known issues in multiple GitHub commits.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
This should allow users to use existing boosted trees APIs for a while until they migrate to TensorFlow Decision Forests, while guaranteeing that known vulnerabilities are fixed.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
These vulnerabilities have been reported by Yu Tian of Qihoo 360 AIVul Team and Faysal Hossain Shezan from University of Virginia. Some of the issues have been discovered internally after a careful audit of the APIs.
GHSA-43q8-3fv7-pr5x
Impact
The implementation of
tf.sparse.split
does not fully validate the input arguments. Hence, a malicious user can trigger a denial of service via a segfault or a heap OOB read:The code assumes
axis
is a scalar. This is another instance of TFSA-2021-190 (CVE-2021-41206).Patches
We have patched the issue in GitHub commit 61bf91e768173b001d56923600b40d9a95a04ad5 (merging #53695).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported externally via a GitHub issue.
CVE-2022-23567
Impact
The implementations of
Sparse*Cwise*
ops are vulnerable to integer overflows. These can be used to trigger large allocations (so, OOM based denial of service) orCHECK
-fails when building newTensorShape
objects (so, assert failures based denial of service):We are missing some validation on the shapes of the input tensors as well as directly constructing a large
TensorShape
with user-provided dimensions. The latter is an instance of TFSA-2021-198 (CVE-2021-41197) and is easily fixed by replacing a call toTensorShape
constructor with a call toBuildTensorShape
static helper factory.Patches
We have patched the issue in GitHub commits 1b54cadd19391b60b6fcccd8d076426f7221d5e8 and e952a89b7026b98fe8cbe626514a93ed68b7c510.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
CVE-2022-23569
Impact
Multiple operations in TensorFlow can be used to trigger a denial of service via
CHECK
-fails (i.e., assertion failures). This is similar to TFSA-2021-198 (CVE-2021-41197) and has similar fixes.Patches
We have patched the reported issues in multiple GitHub commits. It is possible that other similar instances exist in TensorFlow, we will issue fixes as these are discovered.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
CVE-2022-23568
Impact
The implementation of
AddManySparseToTensorsMap
is vulnerable to an integer overflow which results in aCHECK
-fail when building newTensorShape
objects (so, an assert failure based denial of service):We are missing some validation on the shapes of the input tensors as well as directly constructing a large
TensorShape
with user-provided dimensions. The latter is an instance of TFSA-2021-198 (CVE-2021-41197) and is easily fixed by replacing a call toTensorShape
constructor with a call toBuildTensorShape
static helper factory.Patches
We have patched the issue in GitHub commits b51b82fe65ebace4475e3c54eb089c18a4403f1c and a68f68061e263a88321c104a6c911fe5598050a8.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
CVE-2022-21738
Impact
The implementation of
SparseCountSparseOutput
can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation:Patches
We have patched the issue in GitHub commit 6f4d3e8139ec724dbbcb40505891c81dd1052c4a.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
CVE-2022-21736
Impact
The implementation of
SparseTensorSliceDataset
has an undefined behavior: under certain condition it can be made to dereference anullptr
value:The 3 input arguments represent a sparse tensor. However, there are some preconditions that these arguments must satisfy but these are not validated in the implementation.
Patches
We have patched the issue in GitHub commit 965b97e4a9650495cda5a8c210ef6684b4b9eceb.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
CVE-2022-21737
Impact
The implementation of
*Bincount
operations allows malicious users to cause denial of service by passing in arguments which would trigger aCHECK
-fail:There are several conditions that the input arguments must satisfy. Some are not caught during shape inference and others are not caught during kernel implementation. This results in
CHECK
failures later when the output tensors get allocated.Patches
We have patched the issue in GitHub commit 7019ce4f68925fd01cdafde26f8d8c938f47e6f9.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
CVE-2022-21739
Impact
The implementation of
QuantizedMaxPool
has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer.Patches
We have patched the issue in GitHub commit 53b0dd6dc5957652f35964af16b892ec9af4a559.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
CVE-2022-23557
Impact
An attacker can craft a TFLite model that would trigger a division by zero in
BiasAndClamp
implementation:There is no check that the
bias_size
is non zero.Patches
We have patched the issue in GitHub commit 8c6f391a2282684a25cbfec7687bd5d35261a209.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
CVE-2022-21740
Impact
The implementation of
SparseCountSparseOutput
is vulnerable to a heap overflow:Patches
We have patched the issue in GitHub commits 2b7100d6cdff36aa21010a82269bc05a6d1cc74a and adbbabdb0d3abb3cdeac69e38a96de1d678b24b3.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
CVE-2022-21741
Impact
An attacker can craft a TFLite model that would trigger a division by zero in the implementation of depthwise convolutions.
The parameters of the convolution can be user controlled and are also used within a division operation to determine the size of the padding that needs to be added before applying the convolution. There is no check before this division that the divisor is stricly positive.
Patches
We have patched the issue in GitHub commit e5b0eec199c2d03de54fd6a7fd9275692218e2bc.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
CVE-2022-23565
Impact
An attacker can trigger denial of service via assertion failure by altering a
SavedModel
on disk such thatAttrDef
s of some operation are duplicated.Patches
We have patched the issue in GitHub commit c2b31ff2d3151acb230edc3f5b1832d2c713a9e0.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23558
Impact
An attacker can craft a TFLite model that would cause an integer overflow in
TfLiteIntArrayCreate
:The
TfLiteIntArrayGetSizeInBytes
returns anint
instead of asize_t
:An attacker can control model inputs such that
computed_size
overflows the size ofint
datatype.Patches
We have patched the issue in GitHub commit a1e1511dde36b3f8aa27a6ec630838e7ea40e091.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
CVE-2022-23559
Impact
An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations:
Both
embedding_size
andlookup_size
are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication.In certain scenarios, this can then result in heap OOB read/write.
Patches
We have patched the issue in GitHub commits f19be71717c497723ba0cea0379e84f061a75e01, 1de49725a5fc4e48f1a3b902ec3599ee99283043 and a4e401da71458d253b05e41f28637b65baf64be4.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
CVE-2022-23560
Impact
An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors.
Patches
We have patched the issue in GitHub commit 6364463d6f5b6254cac3d6aedf999b6a96225038.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
CVE-2022-23561
Impact
An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.
Patches
We have patched the issue in GitHub commit 6c0b2b70eeee588591680f5b7d5d38175fd7cdf6.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
CVE-2022-23566
Impact
TensorFlow is vulnerable to a heap OOB write in Grappler:
The
set_output
function writes to an array at the specified index:Hence, this gives a malicious user a write primitive.
Patches
We have patched the issue in GitHub commit 97282c6d0d34476b6ba033f961590b783fa184cd.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23562
Impact
The implementation of
Range
suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations.Patches
We have patched the issue in GitHub commit f0147751fd5d2ff23251149ebad9af9f03010732 (merging #51733).
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported externally via a GitHub issue.
CVE-2022-23584
Impact
A malicious user can cause a use after free behavior when decoding PNG images:
After
png::CommonFreeDecode(&decode)
gets called, the values ofdecode.width
anddecode.height
are in an unspecified state.Patches
We have patched the issue in GitHub commit e746adbfcfee15e9cfdb391ff746c765b99bdf9b.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23564
Impact
When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a
CHECK
assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes.Patches
We have patched the issue in GitHub commit 14fea662350e7c26eb5fe1be2ac31704e5682ee6.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
CVE-2022-23563
Impact
In multiple places, TensorFlow uses
tempfile.mktemp
to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename inmktemp
and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness).In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the
mktemp
function usage.Patches
We have patched the issue in several commits, replacing
mktemp
with the safermkstemp
/mkdtemp
functions, according to the usage pattern.The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported on huntr.dev for one scenario and discovered via variant analysis on other instances.
CVE-2022-21726
Impact
The implementation of
Dequantize
does not fully validate the value ofaxis
and can result in heap OOB accesses:The
axis
argument can be-1
(the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked and this results in reading past the end of the array containing the dimensions of the input tensor:Patches
We have patched the issue in GitHub commit 23968a8bf65b009120c43b5ebcceaf52dbc9e943.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
CVE-2022-21727
Impact
The implementation of shape inference for
Dequantize
is vulnerable to an integer overflow weakness:The
axis
argument can be-1
(the default value for the optional argument) or any other positive value at most the number of dimensions of the input. Unfortunately, the upper bound is not checked, and, since the code computesaxis + 1
, an attacker can trigger an integer overflow:Patches
We have patched the issue in GitHub commit b64638ec5ccaa77b7c1eb90958e3d85ce381f91b.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
CVE-2022-21731
Impact
The implementation of shape inference for
ConcatV2
can be used to trigger a denial of service attack via a segfault caused by a type confusion:The
axis
argument is translated intoconcat_dim
in theConcatShapeHelper
helper function. Then, a value formin_rank
is computed based onconcat_dim
. This is then used to validate that thevalues
tensor has at least the required rank:However,
WithRankAtLeast
receives the lower bound as a 64-bits value and then compares it against the maximum 32-bits integer value that could be represented:Due to the fact that
min_rank
is a 32-bits value and the value ofaxis
, therank
argument is a negative value, so the error check is bypassed.Patches
We have patched the issue in GitHub commit 08d7b00c0a5a20926363849f611729f53f3ec022.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported by Yu Tian