Google TensorFlow up to 2.8.3/2.9.2/2.10.0 tf.compat.v1.extract_volume_patches null pointer dereference

Summaryinfo

A vulnerability was found in Google TensorFlow up to 2.8.3/2.9.2/2.10.0 and classified as problematic. This affects the function tf.compat.v1.extract_volume_patches. Executing a manipulation can lead to null pointer dereference. This vulnerability is tracked as CVE-2022-41889. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Google TensorFlow up to 2.8.3/2.9.2/2.10.0 (Artificial Intelligence Software) and classified as problematic. This vulnerability affects the function tf.compat.v1.extract_volume_patches. The manipulation with an unknown input leads to a null pointer dereference vulnerability. The CWE definition for the vulnerability is CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. As an impact it is known to affect availability. CVE summarizes:

TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a `nullptr`, which is not caught. An example can be seen in `tf.compat.v1.extract_volume_patches` by passing in quantized tensors as input `ksizes`. We have patched the issue in GitHub commit e9e95553e5411834d215e6770c81a83a3d0866ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

The weakness was disclosed 11/19/2022 as GHSA-xxcj-rhqg-m46g. The advisory is shared for download at github.com. This vulnerability was named CVE-2022-41889 since 09/30/2022. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

Upgrading to version 2.8.4, 2.9.3, 2.10.1 or 2.11 eliminates this vulnerability. Applying the patch e9e95553e5411834d215e6770c81a83a3d0866ce is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• Google

Name

• TensorFlow

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.8.0
• 2.8.1
• 2.8.2
• 2.8.3
• 2.9
• 2.9.0
• 2.9.1
• 2.9.2
• 2.10.0

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion