CVE-2022-29201: TensorFlow - Incomplete Validation in tf.raw_ops.QuantizedConv2D
Summary
CVE-2022-29201: Missing validation in QuantizedConv2D results in undefined behavior in TensorFlow. Affects tensorflow across 3 version ranges.
< 2.6.4
>= 2.7.0, < 2.7.2
>= 2.8.0, < 2.8.1
Fixed in 2.6.4, 2.7.2 or 2.8.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · PyPI
The same CVE-2022-29201 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including computer vision, natural language processing, and deep learning. This vulnerability affects versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4 of TensorFlow.
Vulnerability Detail
The vulnerability resides in the implementation of tf.raw_ops.QuantizedConv2D in TensorFlow. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the input arguments of this function are not fully validated. As a result, if any argument is empty, references get bound to nullptr. This can lead to various issues, including crashes, memory corruption, and potential remote code execution. The affected versions of TensorFlow have been patched to address this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.42.6.4 -
>= 2.7.0, < 2.7.22.7.2 -
>= 2.8.0, < 2.8.12.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can avoid using the tf.raw_ops.QuantizedConv2D function or ensure that all input arguments are properly validated before invoking the function. Here is an example of how to validate the input arguments:
import tensorflow as tf
def safe_quantized_conv2d(input, filter, strides, padding):
if input is None or filter is None or strides is None or padding is None:
raise ValueError('Input arguments cannot be empty')
return tf.raw_ops.QuantizedConv2D(input, filter, strides, padding)
Conclusion
In conclusion, the vulnerability in TensorFlow's tf.raw_ops.QuantizedConv2D function can lead to crashes, memory corruption, and potential remote code execution. It is recommended to update TensorFlow to versions 2.9.0, 2.8.1, 2.7.2, or 2.6.4 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and libraries for developing and deploying machine learning models.
tf.raw_ops.QuantizedConv2D is a function in TensorFlow that performs quantized 2D convolution on input tensors.
This vulnerability can lead to crashes, memory corruption, and potential remote code execution if exploited by an attacker.
Versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4 of TensorFlow are affected.
To fix this vulnerability, update TensorFlow to versions 2.9.0, 2.8.1, 2.7.2, or 2.6.4, which contain the necessary patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
