CVE-2022-23586: Denial of Service Vulnerability in TensorFlow
Summary
CVE-2022-23586: Multiple CHECK-fails in function.cc in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23586 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in TensorFlow that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability (CVE-2022-23586) in TensorFlow arises from a flaw in the handling of SavedModel files. By manipulating a SavedModel, an attacker can trigger assertions in the function.cc code, causing the Python interpreter to crash. This can result in a DoS condition, rendering the affected TensorFlow instance unavailable. The impact of this vulnerability is limited to the availability of the TensorFlow service and does not allow for remote code execution or unauthorized access to sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. However, users can mitigate the risk by ensuring that only trusted SavedModel files are loaded into TensorFlow instances. It is recommended to validate the integrity and authenticity of SavedModel files before using them in production environments.
Conclusion
The vulnerability in TensorFlow (CVE-2022-23586) can lead to a denial of service (DoS) condition. It is crucial for users to update their TensorFlow installations to the latest patched version or apply the backported fixes to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models.
The vulnerability in TensorFlow can lead to a denial of service (DoS) condition, rendering the affected TensorFlow instance unavailable. However, it does not allow for remote code execution or unauthorized access to sensitive information.
The vulnerability affects TensorFlow versions 2.5.2, 2.6.0, 2.6.1, 2.6.2, and 2.7.0. The issue has been fixed in TensorFlow 2.8.0 and backported to TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3.
To fix this vulnerability, update your TensorFlow installation to the latest patched version. Upgrade to TensorFlow 2.8.0 or apply the backported fixes available for TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3.
While no specific workaround has been mentioned, users can mitigate the risk by ensuring the integrity and authenticity of SavedModel files before loading them into TensorFlow instances.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
