CVE-2022-23574 Information

Description

Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow’s SpecializeType which results in heap OOB read/write. Due to a typo arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the vector of arguments. Since this is a mutable proto value it allows both read and write to outside of bounds data. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1 and TensorFlow 2.6.3 as these are also affected and still in supported range.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reference

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-77gp-3h4r-6428 https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L81-L102 https://github.com/tensorflow/tensorflow/commit/0657c83d08845cc434175934c642299de2c0f042

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8