Buffer overflow in TensorFlow - CVE-2022-41894
Published: February 20, 2024
Vulnerability identifier: #VU86613
CSH Severity: High
CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-41894
CWE-ID: CWE-120
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to reference kernel of the `CONV_3D_TRANSPOSE` TensorFlow Lite operator wrongly increments the data_ptr when adding the bias to the result. A remote unauthenticated attacker can craft a model with a specific number of input channels to write specific values through the bias of the layer outside the bounds of the buffer
Affected software
TensorFlow
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite
Robotic Process Automation for Cloud Pak
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite
Robotic Process Automation for Cloud Pak
How to mitigate CVE-2022-41894
Install updates from vendor's website.
TensorFlow - addressed in versions 2.8.4, 2.9.3, 2.10.1, 2.11.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.2
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.3
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.1, 23.0.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.2
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.3
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.1, 23.0.1
External References
- https://github.com/tensorflow/tensorflow/commit/72c0bdcb25305b0b36842d746cc61d72658d2941
- https://github.com/tensorflow/tensorflow/blob/091e63f0ea33def7ecad661a5ac01dcafbafa90b/tensorflow/lite/kernels/internal/reference/conv3d_transpose.h#L121
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h6q3-vv32-2cq5
Related Security Bulletins
- Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
- Multiple vulnerabilities in IBM Maximo Application Suite
- Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
- Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
- Multiple vulnerabilities in TensorFlow