Vulnerability · Published May 20, 2022 · Assigned by GitHub_M
CVE-2022-29210Heap buffer overflow due to incorrect hash function in TensorFlow
Medium 5.5
In plain English
A medium-severity buffer overflow in tensorflow from tensorflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
TensorFlow is an open source platform for machine learning. In version 2.8.0, the `TensorKey` hash function used total estimated `AllocatedBytes()`, which (a) is an estimate per tensor, and (b) is a very poor hash function for constants (e.g. `int32_t`). It also tried to access individual tensor bytes through `tensor.data()` of size `AllocatedBytes()`. This led to ASAN failures because the `AllocatedBytes()` is an estimate of total bytes allocated by a tensor, including any pointed-to constructs (e.g. strings), and does not refer to contiguous bytes in the `.data()` buffer. The discoverers could not use this byte vector anyway because types such as `tstring` include pointers, whereas they needed to hash the string values themselves. This issue is patched in Tensorflow versions 2.9.0 and 2.8.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | tensorflow | 2.8.1 | GHSA-hc2f-7r5r-r2hg |
| PyPI | tensorflow | 2.8.1 | PYSEC-2026-3200 |
| PyPI | tensorflow-cpu | 2.8.1 | GHSA-hc2f-7r5r-r2hg |
| PyPI | tensorflow-cpu | 2.8.1 | PYSEC-2026-3339 |
| PyPI | tensorflow-gpu | 2.8.1 | GHSA-hc2f-7r5r-r2hg |
| PyPI | tensorflow-gpu | 2.8.1 | PYSEC-2026-1007 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tensorflow | tensorflow | == 2.8.0 |
Weakness: CWE-120, CWE-122 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 x_refsource_MISC
- https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 x_refsource_MISC
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hc2f-7r5r-r2hg x_refsource_CONFIRM
- https://github.com/tensorflow/tensorflow/commit/1b85a28d395dc91f4d22b5f9e1e9a22e92ccecd6 x_refsource_MISC
- https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/framework/tensor_key.h#L53-L64 x_refsource_MISC