CVE-2022-23563: Insecure temporary file in Tensorflow
Impact In multiple places, TensorFlow uses tempfile.mktemp to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in mktemp and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness).
In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the mktemp function usage.
Patches We have patched the issue in several commits, replacing mktemp with the safer mkstemp/mkdtemp functions, according to the usage pattern. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported on huntr.dev for one scenario and discovered via variant analysis on other instances.
Other sources
Tensorflow is an Open Source Machine Learning Framework. In multiple places, TensorFlow uses tempfile.mktemp to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in mktemp and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness). In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the mktemp function usage. We have patched the issue in several commits, replacing mktemp with the safer mkstemp/mkdtemp functions, according to the usage pattern. Users are advised to upgrade as soon as possible.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23563?
CVE-2022-23563 has been classified with a medium severity level due to the risk of race conditions leading to denial of service or other security issues.
How do I fix CVE-2022-23563?
To mitigate CVE-2022-23563, upgrade to TensorFlow versions 2.5.3, 2.6.3, or 2.7.1.
Which versions of TensorFlow are affected by CVE-2022-23563?
The affected versions of TensorFlow include all versions up to 2.5.2 and versions from 2.6.0 to 2.6.2.
What potential risks does CVE-2022-23563 pose?
CVE-2022-23563 may lead to the creation of temporary files that could be manipulated by other processes, potentially resulting in data loss or unauthorized access.
Is CVE-2022-23563 related to temporary file handling in TensorFlow?
Yes, CVE-2022-23563 stems from TensorFlow's unsafe use of tempfile.mktemp, which can create vulnerabilities in how temporary files are handled.