GitHub Advisoryadvisory · PyPI

GHSA-4v5p-v5h9-6xjx `CHECK`-failures in Tensorflow

HIGH Published 2022-02-09 Modified 2024-11-13 Official page ↗
Aliases
CVE-2022-23565
Ecosystem
PyPI
Packages
tensorflow, tensorflow-cpu, tensorflow-gpu
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-617
Reviewed
2022-02-03

Affected packages

• PyPI tensorflow: < 2.5.3 → fixed in 2.5.3 • PyPI tensorflow: >= 2.6.0, < 2.6.3 → fixed in 2.6.3 • PyPI tensorflow: >= 2.7.0, < 2.7.1 → fixed in 2.7.1 • PyPI tensorflow-cpu: < 2.5.3 → fixed in 2.5.3 • PyPI tensorflow-cpu: >= 2.6.0, < 2.6.3 → fixed in 2.6.3 • PyPI tensorflow-cpu: >= 2.7.0, < 2.7.1 → fixed in 2.7.1 • PyPI tensorflow-gpu: < 2.5.3 → fixed in 2.5.3 • PyPI tensorflow-gpu: >= 2.6.0, < 2.6.3 → fixed in 2.6.3 • PyPI tensorflow-gpu: >= 2.7.0, < 2.7.1 → fixed in 2.7.1

Description

Impact An attacker can trigger denial of service via assertion failure by altering a `SavedModel` on disk such that `AttrDef`s of some operation are duplicated. Patches We have patched the issue in GitHub commit c2b31ff2d3151acb230edc3f5b1832d2c713a9e0. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Related

Alias · CVE (1)

  • CVE-2022-23565 Tensorflow is an Open Source Machine Learning Framework. vulnerability

Weakness · CWE (1)

  • CWE-617 Reachable Assertion weakness

References