Vulnerability · Published Feb 4, 2022 · Assigned by GitHub_M
CVE-2022-23576Integer overflow in Tensorflow
Medium 6.5
In plain English
A medium-severity integer overflow in tensorflow from tensorflow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tensorflow is an Open Source Machine Learning Framework. The implementation of `OpLevelCostEstimator::CalculateOutputSize` is vulnerable to an integer overflow if an attacker can create an operation which would involve tensors with large enough number of elements. We can have a large enough number of dimensions in `output_shape.dim()` or just a small number of dimensions being large enough to cause an overflow in the multiplication. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | tensorflow | 2.5.3 | GHSA-wm93-f238-7v37 |
| PyPI | tensorflow | 2.6.3 | GHSA-wm93-f238-7v37 |
| PyPI | tensorflow | 2.7.1 | GHSA-wm93-f238-7v37 |
| PyPI | tensorflow | 2.5.3, 2.6.3, 2.7.1 | PYSEC-2026-3254 |
| PyPI | tensorflow-cpu | 2.6.3 | GHSA-wm93-f238-7v37 |
| PyPI | tensorflow-cpu | 2.7.1 | GHSA-wm93-f238-7v37 |
| PyPI | tensorflow-cpu | 2.5.3, 2.6.3 | PYSEC-2022-85 |
| PyPI | tensorflow-cpu | 2.5.3 | GHSA-wm93-f238-7v37 |
| PyPI | tensorflow-gpu | 2.7.1 | GHSA-wm93-f238-7v37 |
| PyPI | tensorflow-gpu | 2.5.3, 2.6.3 | PYSEC-2022-140 |
| PyPI | tensorflow-gpu | 2.5.3 | GHSA-wm93-f238-7v37 |
| PyPI | tensorflow-gpu | 2.6.3 | GHSA-wm93-f238-7v37 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tensorflow | tensorflow | >= 2.7.0, < 2.7.1>= 2.6.0, < 2.6.3< 2.5.3 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-wm93-f238-7v37 x_refsource_CONFIRM
- https://github.com/tensorflow/tensorflow/commit/b9bd6cfd1c50e6807846af9a86f9b83cafc9c8ae x_refsource_MISC
- https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L1598-L1617 x_refsource_MISC