CVE-2022-23593
published 2022-02-04CVE-2022-23593: Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a…
PriorityP335high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.87%
54.7th percentile
Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | >= 2.7.0 < 2.8.0 | 2.8.0 | |
| intel | optimization_for_tensorflow | >= 2.8.0-rc0 < 2.8.0 | 2.8.0 |
| tensorflow | tensorflow | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_debian5.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2022-23593: tensorflow - Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast`...
vendor_debian·2022·CVSS 5.9
CVE-2022-23593 [MEDIUM] CVE-2022-23593: tensorflow - Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast`...
Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
Scope: local
forky: resolved
sid: resolved
OSV
Segfault in `simplifyBroadcast` in Tensorflow
osv·2022-02-09
CVE-2022-23593 [HIGH] Segfault in `simplifyBroadcast` in Tensorflow
Segfault in `simplifyBroadcast` in Tensorflow
### Impact
The [`simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow](https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/mlir/tfrt/jit/transforms/tf_cpurt_symbolic_shape_optimization.cc#L149-L205) is vulnerable to a segfault (hence, denial of service), if called with scalar shapes.
```cc
size_t maxRank = 0;
for (auto shape : llvm::enumerate(shapes)) {
auto found_shape = analysis.dimensionsForShapeTensor(shape.value());
if (!found_shape) return {};
shapes_found.push_back(*found_shape);
maxRank = std::max(maxRank, found_shape->size());
}
SmallVector
joined_dimensions(maxRank);
```
If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`.
##
GHSA
Segfault in `simplifyBroadcast` in Tensorflow
ghsa·2022-02-09
CVE-2022-23593 [HIGH] CWE-754 Segfault in `simplifyBroadcast` in Tensorflow
Segfault in `simplifyBroadcast` in Tensorflow
### Impact
The [`simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow](https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/mlir/tfrt/jit/transforms/tf_cpurt_symbolic_shape_optimization.cc#L149-L205) is vulnerable to a segfault (hence, denial of service), if called with scalar shapes.
```cc
size_t maxRank = 0;
for (auto shape : llvm::enumerate(shapes)) {
auto found_shape = analysis.dimensionsForShapeTensor(shape.value());
if (!found_shape) return {};
shapes_found.push_back(*found_shape);
maxRank = std::max(maxRank, found_shape->size());
}
SmallVector
joined_dimensions(maxRank);
```
If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`.
##
OSV
CVE-2022-23593: Tensorflow is an Open Source Machine Learning Framework
osv·2022-02-04
CVE-2022-23593 CVE-2022-23593: Tensorflow is an Open Source Machine Learning Framework
Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/mlir/tfrt/jit/transforms/tf_cpurt_symbolic_shape_optimization.cc#L149-L205https://github.com/tensorflow/tensorflow/commit/35f0fabb4c178253a964d7aabdbb15c6a398b69ahttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-gwcx-jrx4-92w2https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/compiler/mlir/tfrt/jit/transforms/tf_cpurt_symbolic_shape_optimization.cc#L149-L205https://github.com/tensorflow/tensorflow/commit/35f0fabb4c178253a964d7aabdbb15c6a398b69ahttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-gwcx-jrx4-92w2
2022-02-04
Published