CVE-2022-23566: TensorFlow Heap OOB Write in Grappler
Summary
CVE-2022-23566: Out of bounds write in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23566 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in TensorFlow's Grappler component, which can lead to a heap out-of-bounds write.
Vulnerability Detail
The vulnerability in TensorFlow's Grappler component arises from the set_output function, which writes to an array at a specified index. This allows a malicious user to gain a write primitive, potentially leading to arbitrary code execution or other unauthorized actions. The issue has been assigned the CVE identifier CVE-2022-23566 and has a severity rating of High. The vulnerability affects TensorFlow versions 2.5.2, 2.6.0, 2.6.1, and 2.7.0. However, it has been fixed in TensorFlow 2.5.3, 2.6.2, and will also be addressed in TensorFlow 2.8.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. It is advised to apply the recommended fix by updating TensorFlow to the patched versions.
Conclusion
TensorFlow is vulnerable to a heap out-of-bounds write in its Grappler component. This vulnerability can be mitigated by updating TensorFlow to the patched versions or by upgrading to TensorFlow 2.8.0 when it becomes available. It is crucial to promptly address this vulnerability to prevent potential unauthorized actions or arbitrary code execution. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models.
The vulnerability in TensorFlow's Grappler component can allow a malicious user to gain a write primitive, potentially leading to arbitrary code execution or other unauthorized actions.
The vulnerability affects TensorFlow versions 2.5.2, 2.6.0, 2.6.1, and 2.7.0.
To fix the vulnerability, it is recommended to update TensorFlow to version 2.5.3 or 2.6.2. Alternatively, upgrading to TensorFlow 2.8.0, once released, will also address the issue.
No specific workaround has been mentioned for this vulnerability. It is advised to apply the recommended fix by updating TensorFlow to the patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
