AVID-2026-R1037

Description

Code injection in saved_model_cli in TensorFlow (CVE-2022-29216)

Details

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, TensorFlow’s saved_model_cli tool is vulnerable to a code injection. This can be used to open a reverse shell. This code path was maintained for compatibility reasons as the maintainers had several test cases where numpy expressions were used as arguments. However, given that the tool is always run manually, the impact of this is still not severe. The maintainers have now removed the safe=False argument, so all parsing is done without calling eval. The patch is available in versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4.

Reason for inclusion in AVID: CVE-2022-29216 describes a code injection vulnerability in TensorFlow’s saved_model_cli, a core tool used within ML pipelines. TensorFlow is a widely used AI framework, and the vulnerability affects software components (not hardware). This directly concerns AI systems' software supply chain (dependencies/tools used to build/train/deploy AI), qualifies as a security/safety vulnerability (potential for RCE), and the report provides explicit evidence (CVE, CVSS, affected versions, references).

References

Affected or Relevant Artifacts

Developer: tensorflow
Deployer: tensorflow
Artifact Details:

Type	Name
System	tensorflow

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score	7.8
Base Severity	🔴 High
Attack Vector	LOCAL
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	🔴 High

CWE

ID	Description
CWE-94	CWE-94: Improper Control of Generation of Code (‘Code Injection’)

Other information

Report Type: Advisory
Credits:
Date Reported: 2022-05-20
Version: 0.3.3
AVID Entry