Heap buffer overflow due to incorrect hash function in TensorFlow
Description
TensorFlow is an open source platform for machine learning. In version 2.8.0, the TensorKey hash function used total estimated AllocatedBytes(), which (a) is an estimate per tensor, and (b) is a very poor hash function for constants (e.g. int32_t). It also tried to access individual tensor bytes through tensor.data() of size AllocatedBytes(). This led to ASAN failures because the AllocatedBytes() is an estimate of total bytes allocated by a tensor, including any pointed-to constructs (e.g. strings), and does not refer to contiguous bytes in the .data() buffer. The discoverers could not use this byte vector anyway because types such as tstring include pointers, whereas they needed to hash the string values themselves. This issue is patched in Tensorflow versions 2.9.0 and 2.8.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tensorflowPyPI | >= 2.8.0, < 2.8.1 | 2.8.1 |
tensorflow-cpuPyPI | >= 2.8.0, < 2.8.1 | 2.8.1 |
tensorflow-gpuPyPI | >= 2.8.0, < 2.8.1 | 2.8.1 |
Affected products
5- osv-coords4 versions
>= 2.8.0, < 2.8.1+ 3 more
- (no CPE)range: >= 2.8.0, < 2.8.1
- (no CPE)range: >= 2.8.0, < 2.8.1
- (no CPE)range: >= 2.8.0, < 2.8.1
- (no CPE)range: >= 2.8.0, < 2.8.1
- Range: == 2.8.0
Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-hc2f-7r5r-r2hgghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-29210ghsaADVISORY
- github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/framework/tensor_key.hghsax_refsource_MISCWEB
- github.com/tensorflow/tensorflow/commit/1b85a28d395dc91f4d22b5f9e1e9a22e92ccecd6ghsax_refsource_MISCWEB
- github.com/tensorflow/tensorflow/releases/tag/v2.8.1ghsax_refsource_MISCWEB
- github.com/tensorflow/tensorflow/releases/tag/v2.9.0ghsax_refsource_MISCWEB
- github.com/tensorflow/tensorflow/security/advisories/GHSA-hc2f-7r5r-r2hgghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.