GitHub Advisoryadvisory · PyPI
GHSA-4v5p-v5h9-6xjx `CHECK`-failures in Tensorflow
HIGH
Official page ↗
- Aliases
- CVE-2022-23565
- Ecosystem
- PyPI
- Packages
- tensorflow, tensorflow-cpu, tensorflow-gpu
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-617
- Reviewed
- 2022-02-03
Affected packages
• PyPI tensorflow: < 2.5.3 → fixed in 2.5.3
• PyPI tensorflow: >= 2.6.0, < 2.6.3 → fixed in 2.6.3
• PyPI tensorflow: >= 2.7.0, < 2.7.1 → fixed in 2.7.1
• PyPI tensorflow-cpu: < 2.5.3 → fixed in 2.5.3
• PyPI tensorflow-cpu: >= 2.6.0, < 2.6.3 → fixed in 2.6.3
• PyPI tensorflow-cpu: >= 2.7.0, < 2.7.1 → fixed in 2.7.1
• PyPI tensorflow-gpu: < 2.5.3 → fixed in 2.5.3
• PyPI tensorflow-gpu: >= 2.6.0, < 2.6.3 → fixed in 2.6.3
• PyPI tensorflow-gpu: >= 2.7.0, < 2.7.1 → fixed in 2.7.1
Description
Impact
An attacker can trigger denial of service via assertion failure by altering a `SavedModel` on disk such that `AttrDef`s of some operation are duplicated.
Patches
We have patched the issue in GitHub commit c2b31ff2d3151acb230edc3f5b1832d2c713a9e0.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
For more information
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Related
Alias · CVE (1)
- CVE-2022-23565 Tensorflow is an Open Source Machine Learning Framework. vulnerability
Weakness · CWE (1)
- CWE-617 Reachable Assertion weakness
References
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-4v5p-v5h9-6xjx web
- https://nvd.nist.gov/vuln/detail/CVE-2022-23565 advisory
- https://github.com/tensorflow/tensorflow/commit/c2b31ff2d3151acb230edc3f5b1832d2c713a9e0 web
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-74.yaml web
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-129.yaml web
- https://github.com/tensorflow/tensorflow web