CVE-2022-23590: TensorFlow GraphDef Malicious Alteration
Summary
CVE-2022-23590: Crash due to erroneous StatusOr in Tensorflow. Affects tensorflow versions < 2.7.1. Fixed in 2.7.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23590 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow allows users to define and execute computational graphs, making it a popular choice for deep learning tasks. However, a vulnerability has been discovered in TensorFlow that allows a malicious actor to alter a GraphDef from a TensorFlow SavedModel. This alteration can cause a TensorFlow process to crash by encountering a StatusOr value that is an error and forcibly extracting the value from it. This vulnerability affects TensorFlow versions prior to 2.7.1.
Vulnerability Detail
The vulnerability arises from the ability to maliciously modify a GraphDef object within a TensorFlow SavedModel. By altering the GraphDef, an attacker can introduce a StatusOr value that represents an error. When the TensorFlow process encounters this altered GraphDef, it attempts to extract the value from the StatusOr object, resulting in a crash. This vulnerability can be exploited remotely, potentially leading to denial of service attacks or other malicious activities. The severity of this vulnerability is rated as high.
How To Fix
Minimum fixed version
2.7.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update TensorFlow to the latest patched version to address the issue.
Conclusion
The vulnerability in TensorFlow allows for the malicious alteration of a GraphDef object, leading to crashes in TensorFlow processes. To address this issue, it is recommended to update TensorFlow to version 2.7.1 or later. The TensorFlow development team has released patches for this vulnerability, which will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem for building and deploying machine learning models.
GraphDef is a protocol buffer message type in TensorFlow that represents a computational graph. It defines the structure and operations of a TensorFlow model.
This vulnerability can be exploited by maliciously altering a GraphDef object within a TensorFlow SavedModel. By introducing a StatusOr value that represents an error, a TensorFlow process can be crashed when encountering the altered GraphDef.
The vulnerability can lead to denial of service attacks or other malicious activities. By crashing TensorFlow processes, an attacker can disrupt machine learning workflows and potentially gain unauthorized access or control over the affected system.
To protect your system, it is crucial to update TensorFlow to the latest patched version (2.7.1 or later). Regularly check for updates and apply them promptly to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
