Advisoriesby IbisIncomplete validation in signal ops leads to crashes in TensorFlow
Impact
The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes (due to CHECK-failures).
Patches
We have patched the issue in GitHub commit [0a8a781e597b18ead006d19b7d23d0a369e9ad73](https://github.com/tensorflow/tensorflow/commit/0a8a781e597b18ead006d19b7d23d0a369e9ad73) (merging GitHub PR [#55274](https://github.com/tensorflow/tensorflow/pull/55274)).
The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.
For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/55263).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| tensorflow PyPI | < 2.6.4 | 2.6.4 |
| >= 2.7.0, < 2.7.2 | 2.7.2 | |
| >= 2.8.0, < 2.8.1 | 2.8.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-20, CWE-617
- Also known as
- BIT-tensorflow-2022-29213, CVE-2022-29213, PYSEC-2026-3107, PYSEC-2026-3277, PYSEC-2026-952
- github.com/tensorflow/tensorflow/security/advisories/GHSA-5889-7v45-q28m
- nvd.nist.gov/vuln/detail/CVE-2022-29213
- github.com/tensorflow/tensorflow/issues/55263
- github.com/tensorflow/tensorflow/pull/55274
- github.com/tensorflow/tensorflow/commit/0a8a781e597b18ead006d19b7d23d0a369e9ad73
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/releases/tag/v2.6.4
- github.com/tensorflow/tensorflow/releases/tag/v2.7.2
- github.com/tensorflow/tensorflow/releases/tag/v2.8.1
- github.com/tensorflow/tensorflow/releases/tag/v2.9.0
More TensorFlow advisories
All TensorFlow
Code injection in `saved_model_cli` in TensorFlowCVE-2022-29216fixed in 2.6.4 +2Core dump when loading TFLite models with quantization in TensorFlowCVE-2022-29212fixed in 2.6.4 +2Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlowCVE-2022-29211fixed in 2.6.4 +2Heap buffer overflow due to incorrect hash function in TensorFlowCVE-2022-29210fixed in 2.8.1Type confusion leading to `CHECK`-failure based denial of service in TensorFlowCVE-2022-29209fixed in 2.6.4 +2Segfault and OOB write due to incomplete validation in `EditDistance` in TensorFlowCVE-2022-29208fixed in 2.6.4 +2