We use cookies to improve your experience on our site.
AVID-2026-R0970
Description
Integer overflows in Tensorflow (CVE-2022-23567)
Details
Tensorflow is an Open Source Machine Learning Framework. The implementations of Sparse*Cwise* ops are vulnerable to integer overflows. These can be used to trigger large allocations (so, OOM based denial of service) or CHECK-fails when building new TensorShape objects (so, assert failures based denial of service). We are missing some validation on the shapes of the input tensors as well as directly constructing a large TensorShape with user-provided dimensions. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Reason for inclusion in AVID: CVE-2022-23567 concerns TensorFlow, a core AI/ML framework. It describes integer overflows in SparseCwise ops leading to OOM-based denial of service or assertion failures, with impact on shapes in user-provided tensors. This directly affects software used to build/train/deploy AI systems, i.e., the AI supply chain (dependencies, runtimes, etc.). The vulnerability is clearly security-related (DoS/invalid state) and is backed by CVE and referenced advisories, providing sufficient evidence for curation.
References
- NVD entry
- https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rrx2-r989-2c43
- https://github.com/tensorflow/tensorflow/commit/1b54cadd19391b60b6fcccd8d076426f7221d5e8
- https://github.com/tensorflow/tensorflow/commit/e952a89b7026b98fe8cbe626514a93ed68b7c510
- https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc
Affected or Relevant Artifacts
- Developer: n/a
- Deployer: n/a
- Artifact Details:
| Type | Name |
|---|---|
| System | n/a |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.1 |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Base Score | 6.5 |
| Base Severity | 🟠 Medium |
| Attack Vector | NETWORK |
| Attack Complexity | 🟢 Low |
| Privileges Required | 🟢 Low |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | 🔴 High |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2022-02-03
- Version: 0.3.3
- AVID Entry