AVID-2026-R1092

Description

CHECK fail in TensorListFromTensor in TensorFlow (CVE-2022-35992)

Details

TensorFlow is an open source platform for machine learning. When TensorListFromTensor receives an element_shape of a rank greater than one, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 3db59a042a38f4338aa207922fa2f476e000a6ee. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Reason for inclusion in AVID: CVE-2022-35992 describes a vulnerability in TensorFlow (TensorListFromTensor) that can trigger a denial of service when element_shape has rank > 1. It affects TensorFlow versions and has a public patch, with references to the commit and advisories. This vulnerability resides in a general-purpose AI software framework, impacting the AI software stack used to build/train/deploy AI systems. As such, it is a software supply-chain relevant issue (not hardware/firmware-specific). The CVE indicates a security/safety vulnerability (DoS) with sufficient public evidence.

References

• NVD entry
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9v8w-xmr4-wgxp
• https://github.com/tensorflow/tensorflow/commit/3db59a042a38f4338aa207922fa2f476e000a6ee

Affected or Relevant Artifacts

• Developer: tensorflow
• Deployer: tensorflow
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CVSS

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2022-09-16
• Version: 0.3.3
• AVID Entry