`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in eager mode
LowPublished Nov 21, 2022 · updated Dec 4, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| tensorflow PyPI | < 2.8.4 | 2.8.4 |
| >= 2.9.0, < 2.9.3 | 2.9.3 | |
| >= 2.10.0, < 2.10.1 | 2.10.1 |
Details and references
### Impact Another instance of CVE-2022-35991, where `TensorListScatter` and `TensorListScatterV2` crash via non scalar inputs in`element_shape`, was found in eager mode and fixed. ```python import tensorflow as tf arg_0=tf.random.uniform(shape=(2, 2, 2), dtype=tf.float16, maxval=None) arg_1=tf.random.uniform(shape=(2, 2, 2), dtype=tf.int32, maxval=65536) arg_2=tf.random.uniform(shape=(2, 2, 2), dtype=tf.int32, maxval=65536) arg_3='' tf.raw_ops.TensorListScatter(tensor=arg_0, indices=arg_1, element_shape=arg_2, name=arg_3) ``` ### Patches We have patched the issue in GitHub commit [bf9932fc907aff0e9e8cccf769e8b00d30fd81a1](https://github.com/tensorflow/tensorflow/commit/bf9932fc907aff0e9e8cccf769e8b00d30fd81a1). The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vulnerability has been reported by Pattarakrit Rattankul
- Severity from
- GitHub (reviewed advisory)
More TensorFlow advisories
All TensorFlow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 212022 | Out of bounds segmentation fault due to unequal op inputs in Tensorflow CVE-2022-41883Medium6.8fixed in 2.10.1 | Medium6.8 | 2.10.1 |
| Nov 212022 | Seg fault in `ndarray_tensor_bridge` due to zero and large inputs CVE-2022-41884Medium4.8fixed in 2.8.4, 2.9.3, 2.10.1 | Medium4.8 | 2.8.4, 2.9.3, 2.10.1 |
| Nov 212022 | Overflow in `FusedResizeAndPadConv2D` CVE-2022-41885Medium4.8fixed in 2.7.4, 2.8.1, 2.9.1 | Medium4.8 | 2.7.4, 2.8.1, 2.9.1 |
| Nov 212022 | Overflow in `ImageProjectiveTransformV2` CVE-2022-41886Medium4.8fixed in 2.8.4, 2.9.3, 2.10.1 | Medium4.8 | 2.8.4, 2.9.3, 2.10.1 |
| Nov 212022 | Overflow in `tf.keras.losses.poisson` CVE-2022-41887Medium4.8fixed in 2.9.3, 2.10.1 | Medium4.8 | 2.9.3, 2.10.1 |
| Nov 212022 | FPE in `tf.image.generate_bounding_box_proposals` CVE-2022-41888Medium4.8fixed in 2.8.4, 2.9.3, 2.10.1 | Medium4.8 | 2.8.4, 2.9.3, 2.10.1 |