CVE-2022-23593: Segfault in `simplifyBroadcast` in Tensorflow
Impact The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes.
cc sizet maxRank = 0; for (auto shape : llvm::enumerate(shapes)) { auto foundshape = analysis.dimensionsForShapeTensor(shape.value()); if (!foundshape) return {}; shapesfound.pushback(foundshape); maxRank = std::max(maxRank, foundshape->size()); }
SmallVector<const ShapeComponentAnalysis::SymbolicDimension> joineddimensions(maxRank);
If all shapes are scalar, then maxRank is 0, so we build an empty SmallVector.
Patches We have patched the issue in GitHub commit 35f0fabb4c178253a964d7aabdbb15c6a398b69a.
The fix will be included in TensorFlow 2.8.0. This is the only affected version.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Other sources
Tensorflow is an Open Source Machine Learning Framework. The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then maxRank is 0, so we build an empty SmallVector. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23593?
CVE-2022-23593 has a moderate severity level due to potential data leakage or incorrect processing.
How do I fix CVE-2022-23593?
To fix CVE-2022-23593, upgrade to TensorFlow version 2.8.0 or higher.
What versions of TensorFlow are affected by CVE-2022-23593?
CVE-2022-23593 affects TensorFlow versions between 2.7.0 and 2.8.0, inclusive.
Is CVE-2022-23593 specific to TensorFlow GPU or CPU?
CVE-2022-23593 impacts both TensorFlow CPU and GPU packages.
What kind of vulnerability is CVE-2022-23593?
CVE-2022-23593 is a technical vulnerability associated with the simplifyBroadcast function in the MLIR-TFRT infrastructure.