CVE-2022-23562: TensorFlow - Integer Overflow in Range Implementation
Summary
CVE-2022-23562: Integer overflow in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23562 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, the implementation of the Range function in TensorFlow suffers from integer overflows, which can lead to undefined behavior or large allocations. This vulnerability affects multiple versions of TensorFlow, including 2.5.2, 2.6.0, and 2.7.0.
Vulnerability Detail
The integer overflow vulnerability in the Range implementation can have severe consequences. It can trigger undefined behavior or result in extremely large allocations, potentially leading to denial-of-service (DoS) attacks or memory corruption. An attacker could exploit this vulnerability to crash the application or execute arbitrary code with the privileges of the TensorFlow process. The impact of this vulnerability depends on the context in which TensorFlow is used and the specific operations performed.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is recommended to apply the provided fix by upgrading to the patched versions of TensorFlow.
Conclusion
The integer overflow vulnerability in TensorFlow's Range implementation can have serious consequences, including DoS attacks and memory corruption. It is crucial to upgrade to the patched versions or the latest TensorFlow release to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides tools and libraries for building and deploying machine learning models.
The vulnerability can lead to undefined behavior, large allocations, and potential denial-of-service (DoS) attacks or memory corruption. It depends on the context and operations performed.
The vulnerability affects TensorFlow versions 2.5.2, 2.6.0, and 2.7.0.
To fix the vulnerability, it is recommended to upgrade to TensorFlow 2.8.0 or later. Alternatively, you can update to the patched versions: TensorFlow 2.7.1, TensorFlow 2.6.3, or TensorFlow 2.5.3.
There is no specific workaround available. It is best to apply the provided fix by upgrading to the patched versions of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
