CVE-2022-23570: Null-dereference in Tensorflow
Impact When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK:
cc const auto attr = attrs.Find(arg->s()); DCHECK(attr != nullptr); if (attr->valuecase() == AttrValue::kList) { // ... } However, DCHECK is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the dereferencing of the null pointer, whereas in the second case it results in a crash due to the assertion failure.
Patches We have patched the issue in GitHub commit 8a513cec4bec15961fbfdedcaa5376522980455c.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Other sources
Tensorflow is an Open Source Machine Learning Framework. When decoding a tensor from protobuf, TensorFlow might do a null-dereference if attributes of some mutable arguments to some operations are missing from the proto. This is guarded by a DCHECK. However, DCHECK is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the dereferencing of the null pointer, whereas in the second case it results in a crash due to the assertion failure. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23570?
CVE-2022-23570 has a medium severity level due to its potential to cause null-dereference vulnerabilities.
How do I fix CVE-2022-23570?
To mitigate CVE-2022-23570, upgrade TensorFlow to version 2.7.1 or higher.
Which versions of TensorFlow are affected by CVE-2022-23570?
CVE-2022-23570 affects TensorFlow versions prior to 2.7.1, including 2.5.2 and 2.6.0 up to 2.6.2.
What impact does CVE-2022-23570 have on TensorFlow functionality?
CVE-2022-23570 can lead to a null-dereference, potentially causing TensorFlow operations to fail.
Is there a patch available for CVE-2022-23570?
Yes, TensorFlow provides patches in the form of updated versions, starting with 2.5.3, 2.6.3, and 2.7.1.