CVE-2022-23580: TensorFlow - Large Vector Allocation Vulnerability
Summary
CVE-2022-23580: Abort caused by allocating a vector that is too large in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23580 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in TensorFlow that can lead to the allocation of a large vector based on a user-controlled value from a tensor during shape inference. This vulnerability can potentially be exploited by an attacker to cause resource exhaustion and denial of service.
Vulnerability Detail
The vulnerability in TensorFlow arises during shape inference, where the framework allocates a large vector based on a value from a tensor controlled by the user. An attacker can manipulate this user-controlled value to trigger the allocation of a disproportionately large vector, leading to resource exhaustion and denial of service. The impact of this vulnerability can be severe, as it can disrupt the availability of TensorFlow-based applications and services. The vulnerability has been assigned the CVE identifier CVE-2022-23580.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As this vulnerability is being addressed through software updates, there is no specific workaround provided. Users are encouraged to follow the recommended steps for updating their TensorFlow installations to the latest patched version.
Conclusion
The vulnerability in TensorFlow that allows for the allocation of a large vector based on a user-controlled value during shape inference can have severe consequences, including resource exhaustion and denial of service. It is crucial for users of TensorFlow to update their installations to the latest patched version as soon as it becomes available. This will ensure that the vulnerability is remediated and the system is protected against potential attacks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models.
The vulnerability in TensorFlow can lead to resource exhaustion and denial of service. It can be exploited by an attacker to disrupt the availability of TensorFlow-based applications and services.
To fix this vulnerability, users should update their TensorFlow installations to the latest patched version as soon as it becomes available. The TensorFlow development team has addressed the vulnerability in TensorFlow 2.8.0 and backported the fix to earlier versions.
As this vulnerability is being addressed through software updates, there are no specific workarounds provided. Users should follow the recommended steps for updating their TensorFlow installations.
For more information about this vulnerability, you can refer to the official TensorFlow documentation, security advisories, and the CVE entry (CVE-2022-23580).
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
