CVE-2022-21740: Heap overflow in Tensorflow
Impact The implementation of SparseCountSparseOutput is vulnerable to a heap overflow:
python import tensorflow as tf import numpy as np
tf.rawops.SparseCountSparseOutput( indices=[[-1,-1]], values=[2], denseshape=[1, 1], weights=[1], binaryoutput=True, minlength=-1, maxlength=-1, name=None)
Patches We have patched the issue in GitHub commits 2b7100d6cdff36aa21010a82269bc05a6d1cc74a and adbbabdb0d3abb3cdeac69e38a96de1d678b24b3.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Other sources
Tensorflow is an Open Source Machine Learning Framework. The implementation of SparseCountSparseOutput is vulnerable to a heap overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-21740?
CVE-2022-21740 has a high severity rating due to the potential for a heap overflow vulnerability in TensorFlow.
How do I fix CVE-2022-21740?
To fix CVE-2022-21740, upgrade TensorFlow to version 2.7.1 or later, or to 2.6.3 if using versions between 2.6.0 and 2.6.2.
Which versions of TensorFlow are affected by CVE-2022-21740?
CVE-2022-21740 affects TensorFlow versions up to 2.5.2, as well as the 2.6.0 to 2.6.2 range and version 2.7.0.
How can CVE-2022-21740 impact my application?
CVE-2022-21740 can impact applications by allowing attackers to exploit the heap overflow, potentially leading to arbitrary code execution.
What steps should I take if I cannot immediately upgrade to resolve CVE-2022-21740?
If you cannot immediately upgrade due to dependencies, consider applying appropriate mitigations such as restricting access and monitoring for anomalous behavior.