CVE-2022-23573: Uninitialized variable access in Tensorflow
(updated )
The implementation of AssignOp can result in copying unitialized data to a new tensor. This later results in undefined behavior.
The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized.
References
- github.com/advisories/GHSA-q85f-69q7-55h2
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-82.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-137.yaml
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/kernels/assign_op.h
- github.com/tensorflow/tensorflow/commit/ef1d027be116f25e25bb94a60da491c2cf55bd0b
- github.com/tensorflow/tensorflow/security/advisories/GHSA-q85f-69q7-55h2
- nvd.nist.gov/vuln/detail/CVE-2022-23573
Code Behaviors & Features
Detect and mitigate CVE-2022-23573 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →