SB2022020340 - Multiple vulnerabilities in TensorFlow

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022020340

SB2022020340 - Multiple vulnerabilities in TensorFlow

Published: February 3, 2022 Updated: February 5, 2024

Security Bulletin ID SB2022020340
Severity
Medium
Patch available
YES
Number of vulnerabilities 23
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 96% Low 4%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 23 secuirty vulnerabilities.


1) Reachable Assertion (CVE-ID: CVE-2022-23571)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion. A remote user can pass a specially crafted user controlled arguments and cause a denial of service.


2) Division by zero (CVE-ID: CVE-2022-23557)

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to a division by zero error when parsing TFLite model in `BiasAndClamp` implementation. A remote user can pass a specially crafted TFLite model to the application and crash it.


3) Out-of-bounds write (CVE-ID: CVE-2022-23574)

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a typo in TensorFlow's SpecializeType. A remote user can pass a specially crafted file, trigger out-of-bounds write and execute arbitrary code on the target system.


4) Reachable Assertion (CVE-ID: CVE-2022-23565)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion. A remote user can assert failure by altering a `SavedModel` on disk such that `AttrDef`s of some operation are duplicated and trigger denial of service.


5) Memory leak (CVE-ID: CVE-2022-23578)

The vulnerability allows a remote user to leak memory and perform DoS attack on the target system.

The vulnerability exists due to leak memory in the implementation of ImmutableExecutorState::Initialize, if a graph node is invalid. A remote user can force the application to leak memory and perform denial of service attack.


6) Integer overflow (CVE-ID: CVE-2022-23562)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in implementation of Range. A remote user can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


7) Out-of-bounds write (CVE-ID: CVE-2022-23566)

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error in the set_output() function in Grappler when processing untrusted input. A remote user can pass a specially crafted file and trigger out-of-bounds write and execute arbitrary code on the target system.


8) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2022-23563)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper implementation of security restrictions in the mktemp() function. A local user can create a specially crafted file and escalate privileges on the system..


9) Use of uninitialized resource (CVE-ID: CVE-2022-23573)

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to implementation of `AssignOp` that can result in copying uninitialized data to a new tensor. A remote use can pass specially crafted data to the application, trigger uninitialized usage of resources and execute arbitrary code on the system.


10) Out-of-bounds write (CVE-ID: CVE-2022-23560)

The vulnerability allows a remote user to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing TFLite model. A remote user can pass a specially crafted TFLite model to the application, trigger out-of-bounds write and execute arbitrary code on the target system.


11) Integer overflow (CVE-ID: CVE-2022-23559)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when processing TFLite model. A remote user can pass specially crafted TFLite model to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


12) Reachable Assertion (CVE-ID: CVE-2022-23583)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion. A remote user can alter a SavedModel such that any binary op would trigger CHECK failures and cause a denial of service.


13) Integer overflow (CVE-ID: CVE-2022-23587)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the Grappler component. A remote user can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


14) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2022-23572)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling in the DCHECK() function. A remote user can send specially crafted data to the application and perform a denial of service (DoS) attack.


15) Use-after-free (CVE-ID: CVE-2022-23584)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when decoding PNG images. A remote attacker can pass a specially crafted PNG image, trigger a use-after-free error and execute arbitrary code on the system.


16) Reachable Assertion (CVE-ID: CVE-2022-23588)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion in Grappler. A remote user can alter a SavedModel and cause a denial of service.


17) Memory leak (CVE-ID: CVE-2022-23585)

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in the png::CommonFreeDecode() function. A remote attacker can pass a specially crafted PNG image, cause memory leak and perform denial of service attack.


18) NULL pointer dereference (CVE-ID: CVE-2022-23570)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the DCHECK() function. A remote user can pass specially crafted data to the application and perform a denial of service (DoS) attack.


19) Reachable Assertion (CVE-ID: CVE-2022-23581)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion in Grappler. A remote user can alter a SavedModel and cause a denial of service.


20) NULL pointer dereference (CVE-ID: CVE-2022-23595)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the BuildXlaCompilationCache() function. A remote user can pass a specially crafted file to the application and perform a denial of service (DoS) attack.


21) Reachable Assertion (CVE-ID: CVE-2022-23586)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion in function.cc. A remote user can alter a SavedModel and cause a denial of service.


22) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2022-21737)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling in the Bincount implementation. A remote user can send a specially crafted data to the application and perform a denial of service (DoS) attack.


23) Integer overflow (CVE-ID: CVE-2022-21738)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the implementation of SparseCountSparseOutput. A remote user can pass a specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Remediation

Install update from vendor's website.

References