BIT-tensorflow-2022-29201: Missing validation in `QuantizedConv2D` results in undefined behavior in TensorFlow
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.QuantizedConv2D does not fully validate the input arguments. In this case, references get bound to nullptr for each argument that is empty. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.9.0 - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.8.1 - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.7.2 - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.6.4
Event History
Frequently Asked Questions
Which TensorFlow releases are affected?
TensorFlow releases before 2.9.0, 2.8.1, 2.7.2, and 2.6.4 are affected. The fixed release depends on the release branch in use.
What level of access does an attacker need?
The supplied vector indicates local access and low privileges are required, with no user interaction. The reported impact is availability only; confidentiality and integrity impacts are not indicated.
What inputs trigger the issue?
The issue occurs when tf.raw_ops.QuantizedConv2D receives empty arguments that are not fully validated. Empty arguments can cause references to be bound to nullptr, resulting in undefined behavior.
How can the issue be remediated?
Upgrade TensorFlow to 2.9.0, 2.8.1, 2.7.2, or 2.6.4, as appropriate for the deployed branch. These releases contain the patch.