CVE-2022-23595: TensorFlow XLA Compilation Cache Null Pointer Dereference
Summary
CVE-2022-23595: Null pointer dereference in TensorFlow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
The same CVE-2022-23595 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow supports various hardware platforms and accelerators, making it a popular choice for deep learning tasks. However, a vulnerability has been discovered in TensorFlow that affects the XLA compilation cache functionality.
Vulnerability Detail
The vulnerability in TensorFlow occurs when building an XLA compilation cache using default settings. In this scenario, TensorFlow triggers a null pointer dereference. Specifically, when all devices are allowed, the flr->config_proto becomes nullptr, leading to the null pointer dereference. This vulnerability can be exploited by an attacker to cause a denial of service (DoS) condition. The impact of this vulnerability is limited to the availability of the TensorFlow application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3 -
>= 2.6.0, < 2.6.32.6.3 -
>= 2.7.0, < 2.7.12.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by ensuring that their TensorFlow installations are updated to the fixed versions once they become available.
Conclusion
The vulnerability in TensorFlow's XLA compilation cache can lead to a null pointer dereference, causing a denial of service condition. Users are advised to update their TensorFlow installations to the fixed versions once they become available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem for building and deploying machine learning models.
The vulnerability can be exploited by an attacker to cause a denial of service (DoS) condition, affecting the availability of the TensorFlow application.
The vulnerability affects TensorFlow versions 2.5.2, 2.6.0, 2.6.1, 2.6.2, and 2.7.0.
There is no specific workaround provided for this vulnerability. However, users can mitigate the risk by updating their TensorFlow installations to the fixed versions once they become available.
To update your TensorFlow installation, you can use the package manager or the appropriate update mechanism for your operating system. Alternatively, you can follow the official TensorFlow documentation for instructions on updating the framework.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
