CVE-2022-21731 — Type Confusion in Intel

Vendor	Product	Version range	Fixed in
debian	tensorflow	—	—
google	tensorflow	<= 2.5.2	—
google	tensorflow	—	—
google	tensorflow	2.6.0 – 2.6.2	—
intel	optimization_for_tensorflow	>= 0 < 2.5.3	2.5.3
intel	optimization_for_tensorflow	>= 2.6.0 < 2.6.3	2.6.3
intel	optimization_for_tensorflow	>= 2.7.0 < 2.7.1	2.7.1

OSV

Type confusion leading to segfault in Tensorflow

osv·2022-02-10

CVE-2022-21731 [HIGH] Type confusion leading to segfault in Tensorflow Type confusion leading to segfault in Tensorflow ### Impact The [implementation of shape inference for `ConcatV2`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/framework/common_shape_fns.cc#L1961-L2059) can be used to trigger a denial of service attack via a segfault caused by a type confusion: ```python import tensorflow as tf @tf.function def test(): y = tf.raw_ops.ConcatV2( values=[[1,2,3],[4,5,6]], axis = 0xb500005b) return y test() ``` The `axis` argument is translated into `concat_dim` in the `ConcatShapeHelper` helper function. Then, a value for `min_rank` is computed based on `concat_dim`. This is then used to validate that the `values` tensor has at least the required rank: ```cc int64_t concat_dim; if (concat_dim_t->

GHSA

Type confusion leading to segfault in Tensorflow

ghsa·2022-02-10

CVE-2022-21731 [HIGH] CWE-754 Type confusion leading to segfault in Tensorflow Type confusion leading to segfault in Tensorflow ### Impact The [implementation of shape inference for `ConcatV2`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/framework/common_shape_fns.cc#L1961-L2059) can be used to trigger a denial of service attack via a segfault caused by a type confusion: ```python import tensorflow as tf @tf.function def test(): y = tf.raw_ops.ConcatV2( values=[[1,2,3],[4,5,6]], axis = 0xb500005b) return y test() ``` The `axis` argument is translated into `concat_dim` in the `ConcatShapeHelper` helper function. Then, a value for `min_rank` is computed based on `concat_dim`. This is then used to validate that the `values` tensor has at least the required rank: ```cc int64_t concat_dim; if (concat_dim_t->

OSV

CVE-2022-21731: Tensorflow is an Open Source Machine Learning Framework

osv·2022-02-03

CVE-2022-21731 CVE-2022-21731: Tensorflow is an Open Source Machine Learning Framework Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denial of service attack via a segfault caused by a type confusion. The `axis` argument is translated into `concat_dim` in the `ConcatShapeHelper` helper function. Then, a value for `min_rank` is computed based on `concat_dim`. This is then used to validate that the `values` tensor has at least the required rank. However, `WithRankAtLeast` receives the lower bound as a 64-bits value and then compares it against the maximum 32-bits integer value that could be represented. Due to the fact that `min_rank` is a 32-bits value and the value of `axis`, the `rank` argument is a negative value, so the error check is bypassed. The fix will be included in TensorFlow 2

Debian

CVE-2022-21731: tensorflow - Tensorflow is an Open Source Machine Learning Framework. The implementation of s...

vendor_debian·2022·CVSS 6.5

CVE-2022-21731 [MEDIUM] CVE-2022-21731: tensorflow - Tensorflow is an Open Source Machine Learning Framework. The implementation of s... Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denial of service attack via a segfault caused by a type confusion. The `axis` argument is translated into `concat_dim` in the `ConcatShapeHelper` helper function. Then, a value for `min_rank` is computed based on `concat_dim`. This is then used to validate that the `values` tensor has at least the required rank. However, `WithRankAtLeast` receives the lower bound as a 64-bits value and then compares it against the maximum 32-bits integer value that could be represented. Due to the fact that `min_rank` is a 32-bits value and the value of `axis`, the `rank` argument is a negative value, so the error check is bypassed. The fix will be included in TensorFlow 2

CVE-2022-21731: Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ConcatV2` can be used to trigger a denial of service attack…

Affected

CVSS provenance