CVE-2022-23567: TensorFlow - Integer Overflow Vulnerability
Summary
CVE-2022-23567: Integer overflows in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23567 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, the implementation of Sparse*Cwise* ops in TensorFlow is vulnerable to integer overflows, which can lead to denial of service attacks or assert failures. These vulnerabilities can be exploited to trigger large allocations, causing out-of-memory errors, or to construct TensorShape objects with user-provided dimensions, resulting in assert failures.
Vulnerability Detail
The vulnerability in TensorFlow arises from the lack of validation on the shapes of input tensors and the direct construction of large TensorShape objects with user-provided dimensions. This allows an attacker to trigger integer overflows, leading to denial of service attacks or assert failures. By exploiting these vulnerabilities, an attacker can cause the target system to crash or become unresponsive, potentially disrupting critical operations or services.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can follow the recommended steps to update TensorFlow to the latest patched version.
Conclusion
The vulnerability in TensorFlow's Sparse*Cwise* ops poses a risk of denial of service attacks and assert failures. It is crucial to update TensorFlow to the latest patched version or apply the relevant fixes to mitigate the risk of exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides tools and resources for building and deploying machine learning models.
This vulnerability in TensorFlow can be exploited to trigger denial of service attacks or assert failures, potentially causing the target system to crash or become unresponsive.
To fix this vulnerability, it is recommended to update TensorFlow to version 2.8.0 or apply the relevant patches.
Yes, older versions of TensorFlow, including 2.7.0, 2.6.0, and 2.5.2, are also affected by this vulnerability. Users of these versions should update to the latest patched version.
There is no specific workaround provided for this vulnerability. Updating to the latest patched version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
