Advisoriesby IbisType confusion leading to `CHECK`-failure based denial of service in TensorFlow
Impact
The [macros that TensorFlow uses for writing assertions (e.g., CHECK_LT, CHECK_GT, etc.)](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/platform/default/logging.h) have an incorrect logic when comparing size_t and int values. Due to type conversion rules, several of the macros would trigger incorrectly.
Patches
We have patched the issue in GitHub commit [b917181c29b50cb83399ba41f4d938dc369109a1](https://github.com/tensorflow/tensorflow/commit/b917181c29b50cb83399ba41f4d938dc369109a1) (merging GitHub PR [#55730](https://github.com/tensorflow/tensorflow/pull/55730)).
The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.
For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/55530).
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| tensorflow PyPI | < 2.6.4 | 2.6.4 |
| >= 2.7.0, < 2.7.2 | 2.7.2 | |
| >= 2.8.0, < 2.8.1 | 2.8.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-843
- Also known as
- BIT-tensorflow-2022-29209, CVE-2022-29209, PYSEC-2026-3167, PYSEC-2026-3315, PYSEC-2026-986
- github.com/tensorflow/tensorflow/security/advisories/GHSA-f4rr-5m7v-wxcw
- nvd.nist.gov/vuln/detail/CVE-2022-29209
- github.com/tensorflow/tensorflow/issues/55530
- github.com/tensorflow/tensorflow/pull/55730
- github.com/tensorflow/tensorflow/commit/b917181c29b50cb83399ba41f4d938dc369109a1
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/platform/default/logging.h
- github.com/tensorflow/tensorflow/releases/tag/v2.6.4
- github.com/tensorflow/tensorflow/releases/tag/v2.7.2
- github.com/tensorflow/tensorflow/releases/tag/v2.8.1
- github.com/tensorflow/tensorflow/releases/tag/v2.9.0
More TensorFlow advisories
All TensorFlow
Code injection in `saved_model_cli` in TensorFlowCVE-2022-29216fixed in 2.6.4 +2Incomplete validation in signal ops leads to crashes in TensorFlowCVE-2022-29213fixed in 2.6.4 +2Core dump when loading TFLite models with quantization in TensorFlowCVE-2022-29212fixed in 2.6.4 +2Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlowCVE-2022-29211fixed in 2.6.4 +2Heap buffer overflow due to incorrect hash function in TensorFlowCVE-2022-29210fixed in 2.8.1Segfault and OOB write due to incomplete validation in `EditDistance` in TensorFlowCVE-2022-29208fixed in 2.6.4 +2