CVE-2022-23592: Out of bounds read in Tensorflow
Impact TensorFlow's type inference can cause a heap OOB read as the bounds checking is done in a DCHECK (which is a no-op during production):
cc if (nodet.typeid() != TFTUNSET) { int ix = inputidx[i]; DCHECK(ix < nodet.argssize()) << "input " << i << " should have an output " << ix << " but instead only has " << nodet.argssize() << " outputs: " << nodet.DebugString(); inputtypes.emplaceback(nodet.args(ix)); // ... } An attacker can control inputidx such that ix would be larger than the number of values in nodet.args. Patches We have patched the issue in GitHub commit c99d98cd189839dcf51aee94e7437b54b31f8abd. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Other sources
Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a DCHECK (which is a no-op during production). An attacker can control the inputidx variable such that ix would be larger than the number of values in nodet.args. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23592?
CVE-2022-23592 has a moderate severity rating due to the potential for heap out of bounds reads.
How do I fix CVE-2022-23592?
To fix CVE-2022-23592, update TensorFlow to version 2.8.0 or later.
What versions of TensorFlow are affected by CVE-2022-23592?
CVE-2022-23592 affects TensorFlow versions between 2.7.0 and 2.8.0.
Is CVE-2022-23592 specific to certain TensorFlow packages?
Yes, CVE-2022-23592 affects various TensorFlow packages including tensorflow, tensorflow-gpu, and tensorflow-cpu within the specified version range.
What is the main cause of CVE-2022-23592?
CVE-2022-23592 is caused by insufficient bounds checking during type inference in TensorFlow.