Executive brief
TensorFlow's SdcaOptimizer component (a machine-learning optimization algorithm) fails to properly validate input tensor dimensions and crashes with a CHECK failure when receiving incorrectly-shaped inputs. An attacker could cause a denial of service by supplying malformed data to training jobs using this optimizer.
Technical details
The vulnerability is an insufficient input validation issue (CWE-20) in the SdcaOptimizer kernel. When the `dense_features` or `example_state_data` parameters are supplied with tensor ranks other than 2, the code triggers an internal CHECK assertion failure rather than gracefully rejecting the invalid input. The vulnerability requires network access and authentication/privileges to call the raw TensorFlow operation. An attacker with the ability to invoke tf.raw_ops.SdcaOptimizer can trigger a denial-of-service crash. A fix was committed in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa and is available in TensorFlow 2.11, 2.10.1, 2.9.3, and 2.8.4.
Affected products
- Google TensorFlow 0.12.0 through 2.8.3, 2.9.0 through 2.9.2, 2.10.0
- Google TensorFlow CPU 1.15.0 through 2.8.3, 2.9.0 through 2.9.2, 2.10.0
- Google TensorFlow GPU 0.12.0 through 2.8.3, 2.9.0 through 2.9.2, 2.10.0
Timeline
- 2022-11-18: disclosed: Published on NVD
- 2022-11-21: advisory: GitHub advisory published
- 2022-11-21: patched: TensorFlow 2.11, 2.10.1, 2.9.3, and 2.8.4 patched