CVE-2022-21739: Null pointer dereference in TensorFlow
Impact The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer.
python import tensorflow as tf
tf.rawops.QuantizedMaxPool( input = tf.constant([[[[4]]]], dtype=tf.quint8), mininput = [], maxinput = [1], ksize = [1, 1, 1, 1], strides = [1, 1, 1, 1], padding = "SAME", name=None )
Patches We have patched the issue in GitHub commit 53b0dd6dc5957652f35964af16b892ec9af4a559.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Other sources
Tensorflow is an Open Source Machine Learning Framework. The implementation of QuantizedMaxPool has an undefined behavior where user controlled inputs can trigger a reference binding to null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21739?
CVE-2022-21739 is classified as a moderate severity vulnerability.
How do I fix CVE-2022-21739?
To fix CVE-2022-21739, upgrade to TensorFlow version 2.7.1 or apply any available patches.
What versions of TensorFlow are affected by CVE-2022-21739?
CVE-2022-21739 affects TensorFlow versions up to 2.5.2 and versions between 2.6.0 and 2.6.2, as well as version 2.7.0.
What type of vulnerability is CVE-2022-21739?
CVE-2022-21739 is a vulnerability related to undefined behavior in the QuantizedMaxPool implementation.
Can CVE-2022-21739 be exploited remotely?
Yes, CVE-2022-21739 can potentially be exploited by attackers using user-controlled inputs.