CVE-2022-23564: TensorFlow Resource Handle Tensor Decoding Denial of Service
Summary
CVE-2022-23564: Reachable Assertion in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23564 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow processes can encounter cases where a CHECK assertion is invalidated based on user-controlled arguments when decoding a resource handle tensor from protobuf. This vulnerability can be exploited by attackers to cause denial of service in TensorFlow processes.
Vulnerability Detail
The vulnerability in TensorFlow arises from a lack of proper validation of user-controlled arguments when decoding a resource handle tensor from protobuf. This can lead to a situation where a CHECK assertion is invalidated, allowing attackers to trigger denial of service attacks against TensorFlow processes. The impact of this vulnerability can range from temporary unavailability of TensorFlow services to complete system crashes, depending on the specific use case and environment. The vulnerability has been assigned CVE-2022-23564 and has a CVSSv3 score of 6.5 (Medium severity).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the provided fix by updating to the patched versions of TensorFlow.
Conclusion
The vulnerability in TensorFlow related to decoding resource handle tensors from protobuf can lead to denial of service attacks. It is crucial to update affected versions of TensorFlow to the patched versions to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem for building and deploying machine learning models.
This vulnerability can be exploited by attackers to cause denial of service in TensorFlow processes, leading to temporary unavailability or system crashes.
The vulnerability affects TensorFlow versions 2.5.2, 2.6.0, 2.6.1, 2.6.2, and 2.7.0.
To fix this vulnerability, update your TensorFlow installation to one of the patched versions: TensorFlow 2.8.0, TensorFlow 2.7.1, TensorFlow 2.6.3, or TensorFlow 2.5.3.
No, there is no known workaround for this vulnerability. It is recommended to update to the patched versions of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
