PYSEC-2026-1050: Segfault via invalid attributes in `pywrap_tfe_src.cc` in Tensorflow

Q: Which deployments are affected?

Affected supported releases include TensorFlow 2.8.4, 2.9.3, and 2.10.1 before their planned cherry-picked fix, as well as versions before TensorFlow 2.11 containing the fix. The issue is in TensorFlow's Python wrapper code.

Q: What must an attacker or user be able to do to trigger the issue?

They need the ability to invoke affected TensorFlow Python APIs with crafted attributes. The provided example triggers the condition by passing a list of quantized tensors as the ksizes input to tf.compat.v1.extract_volume_patches.

Q: What is the impact of successful exploitation?

The invalid quantized-tensor attribute can cause the parser to return a null pointer that is not handled, resulting in a segmentation fault and denial of service.

Q: What should teams do if they cannot immediately upgrade?

Prevent untrusted or insufficiently validated code from supplying TensorFlow operation attributes, particularly lists where tensor values are accepted for attributes such as ksizes. Validate that such attributes contain the expected non-quantized values before invoking the operation.

Published Nov 18, 2022

Updated

TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a nullptr, which is not caught. An example can be seen in tf.compat.v1.extractvolumepatches by passing in quantized tensors as input ksizes. We have patched the issue in GitHub commit e9e95553e5411834d215e6770c81a83a3d0866ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Affected Software

1 affected component

Google TensorFlow<2.8.4, >=2.9.0<2.9.3, >=2.10.0<2.10.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch e9e95553e5411834d215e6770c81a83a3d0866ce

Event History

Nov 18, 2022

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Affected supported releases include TensorFlow 2.8.4, 2.9.3, and 2.10.1 before their planned cherry-picked fix, as well as versions before TensorFlow 2.11 containing the fix. The issue is in TensorFlow's Python wrapper code.

What must an attacker or user be able to do to trigger the issue?

They need the ability to invoke affected TensorFlow Python APIs with crafted attributes. The provided example triggers the condition by passing a list of quantized tensors as the ksizes input to tf.compat.v1.extract_volume_patches.

What is the impact of successful exploitation?

The invalid quantized-tensor attribute can cause the parser to return a null pointer that is not handled, resulting in a segmentation fault and denial of service.

What should teams do if they cannot immediately upgrade?

Prevent untrusted or insufficiently validated code from supplying TensorFlow operation attributes, particularly lists where tensor values are accepted for attributes such as ksizes. Validate that such attributes contain the expected non-quantized values before invoking the operation.

PYSEC-2026-1050: Segfault via invalid attributes in `pywrap_tfe_src.cc` in Tensorflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What must an attacker or user be able to do to trigger the issue?

What is the impact of successful exploitation?

What should teams do if they cannot immediately upgrade?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What must an attacker or user be able to do to trigger the issue?

What is the impact of successful exploitation?

What should teams do if they cannot immediately upgrade?