CVE-2022-29211: TensorFlow - Crash due to NaN elements in tf.histogram_fixed_width
Summary
CVE-2022-29211: Segfault in TensorFlow if tf.histogram_fixed_width is called with NaN values. Affects tensorflow across 3 version ranges.
< 2.6.4
>= 2.7.0, < 2.7.2
>= 2.8.0, < 2.8.1
Fixed in 2.6.4, 2.7.2 or 2.8.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · PyPI
The same CVE-2022-29211 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various industries and research domains for tasks such as image recognition, natural language processing, and recommendation systems. However, prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, TensorFlow is vulnerable to a crash when using the tf.histogram_fixed_width function with arrays containing NaN elements.
Vulnerability Detail
The vulnerability in TensorFlow's tf.histogram_fixed_width function arises from an assumption made during the implementation. The function converts a floating point result to an integer index, assuming that all floating point operations are defined. However, if the input array (values) contains NaN elements, the result of the division operation becomes NaN, and the subsequent cast to int32 leads to a crash. It's important to note that this vulnerability only affects the CPU implementation of TensorFlow. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 have been patched to address this issue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.42.6.4 -
>= 2.7.0, < 2.7.22.7.2 -
>= 2.8.0, < 2.8.12.8.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can manually check the input array (values) for NaN elements before calling tf.histogram_fixed_width. If any NaN elements are found, they can be replaced with a suitable value (e.g., 0) to avoid the crash. Here's an example code snippet in Python:
import numpy as np
import tensorflow as tf
values = np.array([1.0, 2.0, np.nan, 4.0])
values = np.where(np.isnan(values), 0, values)
histogram = tf.histogram_fixed_width(values, ...)
This code snippet uses the NumPy library to replace NaN elements with 0 before passing the array to tf.histogram_fixed_width.
Conclusion
In conclusion, TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4 are vulnerable to a crash caused by NaN elements in the tf.histogram_fixed_width function. This vulnerability can be mitigated by updating TensorFlow to the patched versions. Users can refer to the official TensorFlow documentation for detailed instructions on upgrading their installations. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for building and deploying machine learning models.
tf.histogram_fixed_width is a function in TensorFlow that computes a histogram of values using fixed-width bins.
The vulnerability occurs when the input array (values) passed to tf.histogram_fixed_width contains NaN elements, leading to a crash due to an assumption made during the implementation.
Versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4 are affected by this vulnerability.
To fix this vulnerability, update TensorFlow to version 2.9.0, 2.8.1, 2.7.2, or 2.6.4, which contain the necessary patches to address the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
