CVE-2022-21726: TensorFlow - Heap Out-of-Bounds Access in Dequantize
Summary
CVE-2022-21726: Out of bounds read in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-21726 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in the implementation of the Dequantize function in TensorFlow.
Vulnerability Detail
The vulnerability (CVE-2022-21726) arises from inadequate validation of the axis parameter in the Dequantize function. The axis argument can be set to -1 or any positive value up to the number of dimensions of the input tensor. However, the upper bound is not properly checked, leading to heap out-of-bounds accesses. This can result in reading past the end of the array containing the dimensions of the input tensor. The issue has been assigned a severity rating of High.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As this vulnerability is being addressed through software updates, there is no specific workaround provided. Users are encouraged to follow the recommended steps for updating their TensorFlow installations to the latest patched version.
Conclusion
The vulnerability in TensorFlow's Dequantize function has been identified and addressed by the TensorFlow team. Users are strongly advised to update their TensorFlow installations to the latest patched version once it becomes available. Regularly checking for updates and applying them promptly is crucial to ensure the security of TensorFlow deployments. For further support and assistance with vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models.
The vulnerability can lead to heap out-of-bounds accesses, potentially resulting in memory corruption and arbitrary code execution. This can be exploited by an attacker to gain unauthorized access, manipulate data, or cause a denial-of-service condition.
The vulnerability affects TensorFlow versions 2.5.2, 2.6.0, 2.6.1, 2.6.2, and 2.7.0. Users of these versions are advised to update to the latest patched version once it becomes available.
To update your TensorFlow installation, you can use the package manager or the appropriate update mechanism for your operating system. Alternatively, you can follow the instructions provided by the TensorFlow team for updating to the latest version.
You can find more information about this vulnerability, including the technical details and the fix, in the official TensorFlow release notes and security advisories.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
