CVE-2022-23594 Out of bounds read in Tensorflow
Attackers can trigger out-of-bounds reads or writes in TensorFlow by providing a malicious SavedModel, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23594?
CVE-2022-23594 is a high-severity memory corruption vulnerability in Google Tensorflow, published on 4 Feb 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Tensorflow is an Open Source Machine Learning Framework. The TFG dialect of TensorFlow (MLIR) makes several assumptions about the incoming `GraphDef` before converting it to the MLIR-based dialect. If an attacker changes the `SavedModel` format on disk to invalidate these assumptions and the `GraphDef` is then converted to MLIR-based IR then they can cause a crash in the Python interpreter. Under certain scenarios, heap OOB read/writes are possible. These issues have been discovered via fuzzing and it is possible that more weaknesses exist. We will patch them as they are discovered.
Which versions are affected by CVE-2022-23594?
10 open source packages ship an affected version, including tensorflow, tensorflow-cpu and tensorflow-gpu. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tensorflow Bitnami | From 2.7.0 | 2.7.1 |
tensorflow PyPI | From 2.7.0 | 2.7.1 |
tensorflow PyPI | From 2.7.0 | 2.7.1 |
tensorflow PyPI | From 2.7.0 | 2.7.1 |
tensorflow-cpu PyPI | From 2.7.0 | 2.7.1 |
tensorflow-cpu PyPI | From 2.7.0 | 2.7.1 |
4 more packages
tensorflow-cpu PyPI | From 2.7.0 | 2.7.1 |
tensorflow-gpu PyPI | From 2.7.0 | 2.7.1 |
tensorflow-gpu PyPI | From 2.7.0 | 2.7.1 |
tensorflow-gpu PyPI | From 2.7.0 | 2.7.1 |
Products include Google Tensorflow.
How do I fix CVE-2022-23594?
Upgrade tensorflow to 2.7.1 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2022-23594 being exploited?
There is no known exploitation of CVE-2022-23594 in the wild and no public exploit code.
Other vulnerabilities in Google Tensorflow
- CVE-2023-25668 TensorFlow vulnerable to heap out-of-buffer read in the QuantizeAndDequantize operation
- CVE-2018-7575 Integer Overflow or Wraparound in Google TensorFlow
- CVE-2021-37678 Arbitrary code execution due to YAML deserialization
- CVE-2021-35958 Path traversal in n/a
- CVE-2020-15202 Integer truncation in Shard API usage
Sources
Also known as BIT-tensorflow-2022-23594, GHSA-9x52-887g-fhc2, PYSEC-2026-3157, PYSEC-2026-3309, PYSEC-2026-752.