GitHub Advisoryadvisory · PyPI

GHSA-5f2r-qp73-37mr `CHECK`-failures during Grappler's `SafeToRemoveIdentity` in Tensorflow

MEDIUM Published 2022-02-10 Modified 2024-11-07 Official page ↗
Aliases
CVE-2022-23579
Ecosystem
PyPI
Packages
tensorflow, tensorflow-cpu, tensorflow-gpu
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-617
Reviewed
2022-02-04

Affected packages

• PyPI tensorflow: < 2.5.3 → fixed in 2.5.3 • PyPI tensorflow: >= 2.6.0, < 2.6.3 → fixed in 2.6.3 • PyPI tensorflow: >= 2.7.0, < 2.7.1 → fixed in 2.7.1 • PyPI tensorflow-cpu: < 2.5.3 → fixed in 2.5.3 • PyPI tensorflow-cpu: >= 2.6.0, < 2.6.3 → fixed in 2.6.3 • PyPI tensorflow-cpu: >= 2.7.0, < 2.7.1 → fixed in 2.7.1 • PyPI tensorflow-gpu: < 2.5.3 → fixed in 2.5.3 • PyPI tensorflow-gpu: >= 2.6.0, < 2.6.3 → fixed in 2.6.3 • PyPI tensorflow-gpu: >= 2.7.0, < 2.7.1 → fixed in 2.7.1

Description

Impact The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `SafeToRemoveIdentity` would trigger `CHECK` failures. Patches We have patched the issue in GitHub commit 92dba16749fae36c246bec3f9ba474d9ddeb7662. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Related

Alias · CVE (1)

  • CVE-2022-23579 Tensorflow is an Open Source Machine Learning Framework. vulnerability

Weakness · CWE (1)

  • CWE-617 Reachable Assertion weakness

References