// For flags

CVE-2022-23583

`CHECK`-failures in binary ops in Tensorflow

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that any binary op would trigger `CHECK` failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the `dtype` no longer matches the `dtype` expected by the op. In that case, calling the templated binary operator for the binary op would receive corrupted data, due to the type confusion involved. If `Tin` and `Tout` don't match the type of data in `out` and `input_*` tensors then `flat<*>` would interpret it wrongly. In most cases, this would be a silent failure, but we have noticed scenarios where this results in a `CHECK` crash, hence a denial of service. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Tensorflow es un Marco de Aprendizaje Automático de Código Abierto. Un usuario malicioso puede causar una denegación de servicio alterando un "SavedModel" de tal manera que cualquier operación binaria desencadene fallos de "CHECK". Esto ocurre cuando la parte del protobuf correspondiente a los argumentos del tensor es modificada de forma que el "dtype" ya no coincide con el "dtype" esperado por la op. En ese caso, la llamada al operador binario templado para la op binaria recibiría datos corruptos, debido a la confusión de tipos implicada. Si "Tin" y "Tout" no coinciden con el tipo de datos de los tensores "out" y "input_*", entonces "flat(*)" lo interpretaría de forma errónea. En la mayoría de los casos, esto sería un fallo silencioso, pero hemos observado escenarios en los que esto resulta en un bloqueo de "CHECK", por lo tanto una denegación de servicio. La corrección será incluida en TensorFlow versión 2.8.0. También seleccionaremos este commit en TensorFlow versión 2.7.1, TensorFlow versión 2.6.3, y TensorFlow versión 2.5.3, ya que estos también están afectados y aún están en el rango admitido

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-01-19 CVE Reserved
  • 2022-02-04 CVE Published
  • 2024-04-28 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-617: Reachable Assertion
  • CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Google
Search vendor "Google"
 Tensorflow
Search vendor "Google" for product "Tensorflow"
 <= 2.5.2
Search vendor "Google" for product "Tensorflow" and version " <= 2.5.2"
-
Affected
Google
Search vendor "Google"
 Tensorflow
Search vendor "Google" for product "Tensorflow"
 >= 2.6.0 <= 2.6.2
Search vendor "Google" for product "Tensorflow" and version " >= 2.6.0 <= 2.6.2"
-
Affected
Google
Search vendor "Google"
 Tensorflow
Search vendor "Google" for product "Tensorflow"
 2.7.0
Search vendor "Google" for product "Tensorflow" and version "2.7.0"
-
Affected