CVE-2022-23589
Null pointer dereference in Grappler's `IsConstant` in Tensorflow
描述
Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur, for the same malicious alteration of a `SavedModel` file (fixing the first one would trigger the same dereference in the second place). First, during constant folding, the `GraphDef` might not have the required nodes for the binary operation. If a node is missing, the correposning `mul_*child` would be null, and the dereference in the subsequent line would be incorrect. We have a similar issue during `IsIdentityConsumingSwitch`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
如何修補 CVE-2022-23589
要修補 CVE-2022-23589,請將受影響套件升級到下列已修補版本。
- —升級至 2.5.3 或更新版本
- —升級至 2.5.3 或更新版本
- —升級至 2.5.3 或更新版本
- —升級至 2.5.3 或更新版本
- —升級至 0a365c029e437be0349c31f8d4c9926b69fa3fa1 或更新版本
- —升級至 2.5.3 或更新版本
- —升級至 0a365c029e437be0349c31f8d4c9926b69fa3fa1 或更新版本
CVE-2022-23589 正在被利用嗎?
低 — EPSS 為 1.1%,目前沒有觀察到大規模利用活動。
受影響套件(7)
- from 0, < 2.5.3, >= 2.6.0, < 2.6.3, >= 2.7.0, < 2.7.1
- from 0, < 2.5.3
- from 0, < 2.5.3, >= 2.6.0, < 2.6.3, >= 2.7.0, < 2.7.1
- from 0, < 2.5.3
- from 0, < 0a365c029e437be0349c31f8d4c9926b69fa3fa1, < 045deec1cbdebb27d817008ad5df94d96a08b1bf | from 0, < 2.5.3, >= 2.6.0, < 2.6.3
- from 0, < 2.5.3
- from 0, < 0a365c029e437be0349c31f8d4c9926b69fa3fa1, < 045deec1cbdebb27d817008ad5df94d96a08b1bf | from 0, < 2.5.3, >= 2.6.0, < 2.6.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |