CVE-2022-23576: TensorFlow - Integer Overflow in OpLevelCostEstimator::CalculateOutputSize
Summary
CVE-2022-23576: Integer overflow in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23576 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. This vulnerability affects versions 2.5.2, 2.6.0, and 2.6.2 of TensorFlow, as well as version 2.7.0. It is caused by an integer overflow in the OpLevelCostEstimator::CalculateOutputSize implementation, which can be exploited by an attacker to create an operation involving tensors with a large number of elements. The multiplication of a large number of dimensions in output_shape.dim() or a small number of dimensions being large enough can trigger the overflow. This vulnerability has a medium severity rating.
Vulnerability Detail
The vulnerability in TensorFlow's OpLevelCostEstimator::CalculateOutputSize can lead to an integer overflow when dealing with tensors containing a large number of elements. An attacker can exploit this vulnerability by crafting an operation that triggers the overflow. The consequences of this vulnerability can vary depending on the specific use case, but they may include memory corruption, crashes, or even remote code execution. The fix for this vulnerability will be included in TensorFlow 2.8.0, and patches will also be provided for TensorFlow 2.7.1, 2.6.3, and 2.5.3.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can mitigate the risk by avoiding operations that involve tensors with an excessively large number of elements. This can be achieved by carefully designing the input data or modifying the operations to work with smaller tensors. However, this workaround may not be feasible in all scenarios and should only be considered as a temporary measure until the official fix is applied.
Conclusion
The vulnerability in TensorFlow's OpLevelCostEstimator::CalculateOutputSize can result in an integer overflow when dealing with tensors containing a large number of elements. This can have various consequences, including memory corruption, crashes, or even remote code execution. It is crucial to update TensorFlow to version 2.8.0 or apply the provided patches for versions 2.7.1, 2.6.3, and 2.5.3 to mitigate the risk. For further assistance and support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem for building and deploying machine learning models.
This vulnerability can lead to memory corruption, crashes, or even remote code execution, depending on the specific use case.
Versions 2.5.2, 2.6.0, 2.6.2, and 2.7.0 of TensorFlow are affected by this vulnerability.
The fix for this vulnerability will be included in TensorFlow 2.8.0. Patches will also be provided for TensorFlow 2.7.1, 2.6.3, and 2.5.3.
As a temporary workaround, users can avoid operations involving tensors with a large number of elements. This can be achieved by carefully designing the input data or modifying the operations to work with smaller tensors.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
