GoogleOSV:BIT-TENSORFLOW-2022-41893

HistoryMar 06, 2024 - 11:11 a.m.

BIT-tensorflow-2022-41893

2024-03-0611:11:03

Google

osv.dev

tensorflow

machine learning

security flaw

denial of service

github commit

patch

cherrypick

supported versions

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.7%

JSON

TensorFlow is an open source platform for machine learning. If tf.raw_ops.TensorListResize is given a nonscalar value for input size, it results CHECK fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

CPENameOperatorVersion
tensorflowlt2.9.3
tensorflowlt2.8.4
tensorflowge2.10.0
tensorflowlt2.10.1
tensorflowge2.9.0

Name	Operator	Version
tensorflow	lt	2.9.3
tensorflow	lt	2.8.4
tensorflow	ge	2.10.0
tensorflow	lt	2.10.1
tensorflow	ge	2.9.0

References

github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/list_kernels.cc

github.com/tensorflow/tensorflow/commit/888e34b49009a4e734c27ab0c43b0b5102682c56

github.com/tensorflow/tensorflow/security/advisories/GHSA-67pf-62xr-q35m