CVE-2022-21738: TensorFlow - Integer Overflow leading to Memory Allocation Crash
Summary
CVE-2022-21738: Integer overflow leading to crash in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-21738 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in the implementation of SparseCountSparseOutput in TensorFlow, which can lead to a crash of the TensorFlow process due to an integer overflow. This vulnerability affects multiple versions of TensorFlow, including 2.5.2, 2.6.0, and 2.7.0.
Vulnerability Detail
The vulnerability arises from an integer overflow in the SparseCountSparseOutput implementation, where the result of the overflow is subsequently used in a memory allocation. An attacker could exploit this vulnerability by crafting a malicious input that triggers the integer overflow, leading to a crash of the TensorFlow process. The impact of this vulnerability can range from denial of service to potential remote code execution, depending on the context in which TensorFlow is used. The severity of this vulnerability is rated as Medium.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can consider implementing input validation and sanitization mechanisms to prevent the exploitation of this vulnerability. By carefully validating and sanitizing the input data, the risk of triggering the integer overflow can be mitigated. However, this workaround may not provide complete protection and should be seen as a temporary measure until the fixed versions of TensorFlow are available.
Conclusion
In conclusion, a vulnerability has been identified in TensorFlow that can lead to a crash of the TensorFlow process due to an integer overflow. The impact of this vulnerability can range from denial of service to potential remote code execution. It is crucial for users to update their TensorFlow installations to the fixed versions once they are released. Regularly checking for updates and promptly applying them is recommended to ensure the security and stability of TensorFlow deployments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models.
The impact of this vulnerability can range from denial of service to potential remote code execution, depending on the context in which TensorFlow is used.
This vulnerability affects TensorFlow versions 2.5.2, 2.6.0, and 2.7.0.
The fix for this vulnerability will be included in TensorFlow 2.8.0. Users are advised to update their TensorFlow installations to the fixed versions as soon as they become available.
As a temporary workaround, users can implement input validation and sanitization mechanisms to mitigate the risk of triggering the vulnerability. However, this workaround may not provide complete protection.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
