CVE-2022-21734: TensorFlow MapStage Key Tensor Vulnerability
Summary
CVE-2022-21734: CHECK-failures in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-21734 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. This vulnerability affects the implementation of the MapStage function in TensorFlow.
Vulnerability Detail
The vulnerability arises when the key tensor provided to the MapStage function is not a scalar. This triggers a CHECK-fail, leading to a potential denial-of-service (DoS) scenario. An attacker could exploit this vulnerability by providing a non-scalar key tensor, causing the program to terminate abruptly. The impact of this vulnerability can range from disruption of machine learning workflows to potential system instability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by upgrading to the patched versions of TensorFlow.
Conclusion
The vulnerability in TensorFlow's MapStage function can lead to a denial-of-service scenario and potential system instability. Users are strongly advised to upgrade to the patched versions of TensorFlow or apply the official fix provided by the TensorFlow development team. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a wide range of tools and resources for building and deploying machine learning models.
This vulnerability can lead to a denial-of-service (DoS) scenario, potentially disrupting machine learning workflows and causing system instability.
To fix this vulnerability, you should upgrade your TensorFlow installation to version 2.8.0 or later. If you are using an older version within the supported range, you can also update to the corresponding patched releases.
No, there is no known workaround for this vulnerability. It is recommended to apply the official fix by upgrading to the patched versions of TensorFlow.
You can find more information about this vulnerability in the official TensorFlow documentation and the vulnerability database provided by Bitnami.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
