CVE-2022-23589: TensorFlow Grappler Component Null Pointer Dereference
Summary
CVE-2022-23589: Null pointer dereference in Grappler's IsConstant in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23589 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem for building and deploying machine learning models. The Grappler component in TensorFlow is responsible for optimizing and transforming computational graphs. It plays a crucial role in improving the performance and efficiency of TensorFlow models.
Vulnerability Detail
The vulnerability identified as CVE-2022-23589 affects the Grappler component of TensorFlow. Under certain scenarios, a null pointer dereference can be triggered, leading to a crash or potential exploitation. There are two specific instances where this vulnerability can occur. Firstly, during constant folding, if the required nodes for a binary operation are missing in the GraphDef, the corresponding multiplication child nodes may be null, resulting in an incorrect dereference. Secondly, a similar issue arises during the 'IsIdentityConsumingSwitch' process. This vulnerability can be exploited by maliciously altering a 'SavedModel' file. The TensorFlow team has addressed this vulnerability in TensorFlow 2.8.0 and will also provide patches for TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these versions are still within the supported range.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is crucial to update TensorFlow to the patched versions mentioned above.
Conclusion
The vulnerability in the Grappler component of TensorFlow can lead to a null pointer dereference, potentially resulting in a crash or exploitation. It is crucial to update TensorFlow to the patched versions or apply the provided patches to ensure the security of your TensorFlow installation. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem for building and deploying machine learning models.
The Grappler component in TensorFlow is responsible for optimizing and transforming computational graphs. It plays a crucial role in improving the performance and efficiency of TensorFlow models.
This vulnerability can be exploited by maliciously altering a 'SavedModel' file. By triggering a null pointer dereference in the Grappler component, an attacker can potentially crash the system or execute arbitrary code.
The vulnerability affects TensorFlow versions 2.5.2, 2.6.0, 2.6.1, 2.6.2, and 2.7.0. TensorFlow 2.8.0 and later versions are not affected.
To protect your TensorFlow installation, it is recommended to update to TensorFlow 2.8.0 or apply the provided patches for TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
