CVE-2022-23594:TensorFlow 2.7.x before 2.8.0 contains an out-of-bounds read/write vulnerability that can crash the Python interpreter when a tampered SavedModel is converted from GraphDef to MLIR IR, exploitable by a local attacker with low privileges.

splash
Back

Description Preview

This CVE describes a vulnerability in TensorFlow where the TFG dialect’s assumptions about the incoming GraphDef can be invalidated if an attacker alters the SavedModel on disk. When the modified SavedModel is loaded and the GraphDef is converted to the MLIR-based IR, this can lead to a crash in the Python interpreter and, under certain scenarios, heap-based out-of-bounds reads or writes. The issue was discovered via fuzzing, and TensorFlow notes that additional weaknesses may exist and will be patched as discovered. The affected range is TensorFlow versions >= 2.7.0 and < 2.8.0, with a high-severity impact across confidentiality, integrity, and availability, and an attacker requiring local access with low privileges and no user interaction.

Overview

TensorFlow contains a high-severity, local vulnerability (CVE-2022-23594) in which tampering with a SavedModel can invalidate GraphDef assumptions that are used when converting to the MLIR-based IR. If the GraphDef is converted under these compromised conditions, the Python interpreter can crash, and heap out-of-bounds reads or writes may occur. The vulnerability affects TensorFlow 2.7.0 through versions prior to 2.8.0. The attack is low in complexity and does not require user interaction, though it necessitates local access and low privileges. The issue was found via fuzzing, and the project has indicated that additional weaknesses could exist and will be patched as they are discovered.

Remediation

  • Upgrade TensorFlow to version 2.8.0 or newer (the fixed release for this issue).
  • If upgrading immediately is not feasible, apply any available security patches or backports from TensorFlow and monitor for advisories related to CVE-2022-23594.
  • Enforce integrity checks on SavedModel artifacts before loading (e.g., checksums, digital signatures) and limit the ability to modify SavedModels in production environments.
  • Restrict access to the directory containing SavedModel data to trusted principals; use least-privilege principles and strong access controls to prevent unauthorized tampering.
  • Validate inputs and configurations during model loading and GraphDef/MLIR conversion paths; consider enabling additional runtime or memory-safety hardening and fuzz-testing in development environments.
  • After patching, re-test the model loading and conversion workflow to confirm that the vulnerability is mitigated and that no regressions were introduced.

References

Industry ExposureMost to least
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.

  1. Manufacturing: Low
    Manufacturing
  2. Finance and Insurance: Low
    Finance and Insurance
  3. Management of Companies & Enterprises: Low
    Management of Companies & Enterprises
  4. Retail Trade: Low
    Retail Trade
  5. Accommodation & Food Services: Low
    Accommodation & Food Services
  6. Administrative, Support, Waste Management & Remediation Services: Low
    Administrative, Support, Waste Management & Remediation Services
  7. Agriculture, Forestry Fishing & Hunting: Low
    Agriculture, Forestry Fishing & Hunting
  8. Arts, Entertainment & Recreation: Low
    Arts, Entertainment & Recreation
  9. Construction: Low
    Construction
  10. Educational Services: Low
    Educational Services
  11. Health Care & Social Assistance: Low
    Health Care & Social Assistance
  12. Information: Low
    Information
  13. Mining: Low
    Mining
  14. Other Services (except Public Administration): Low
    Other Services (except Public Administration)
  15. Professional, Scientific, & Technical Services: Low
    Professional, Scientific, & Technical Services
  16. Public Administration: Low
    Public Administration
  17. Real Estate Rental & Leasing: Low
    Real Estate Rental & Leasing
  18. Transportation & Warehousing: Low
    Transportation & Warehousing
  19. Utilities: Low
    Utilities
  20. Wholesale Trade: Low
    Wholesale Trade

Focus on What Matters

  1. See Everything.
  2. Identify True Risk.
  3. Proactively Mitigate Threats.

Let's talk!

background