Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is given a nonscalar value for input `size`, it results `CHECK` fail which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 888e34b49009a4e734c27ab0c43b0b5102682c56. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

CVE-2022-41893 is a medium-severity vulnerability identified in TensorFlow, an open-source machine learning platform widely used for developing and deploying machine learning models. The vulnerability arises from a reachable assertion failure (CWE-617) within the TensorFlow operation `tf.raw_ops.TensorListResize`. Specifically, when this operation receives a nonscalar value for its `size` input parameter, it triggers a `CHECK` failure, causing the program to terminate unexpectedly. This behavior can be exploited to cause a denial of service (DoS) condition by crashing applications that rely on the affected TensorFlow versions. The affected versions include TensorFlow releases from 2.8.4 and earlier, as well as versions 2.9.0 up to but not including 2.9.3, and 2.10.0 up to but not including 2.10.1. The issue has been addressed in a GitHub commit (888e34b49009a4e734c27ab0c43b0b5102682c56) and will be included in TensorFlow 2.11, with backported fixes planned for 2.10.1, 2.9.3, and 2.8.4. No known exploits have been reported in the wild to date. The vulnerability does not require authentication or user interaction to be triggered, but exploitation requires the ability to supply crafted inputs to the TensorFlow API, which typically implies some level of access to the machine learning environment or application using TensorFlow. The impact is primarily a denial of service through application crashes rather than data compromise or code execution.

Detailed information about CVE-2022-41893: CWE-617: Reachable Assertion in tensorflow tensorflow affecting tensorflow tensorflow. Get real-time updates, technic

CVE-2022-41893: CWE-617: Reachable Assertion in tensorflow tensorflow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-41893: CWE-617: Reachable Assertion in tensorflow tensorflow

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that Grappler optimizer would attempt to build a tensor using a reference `dtype`. This would result in a crash due to a `CHECK`-fail in the `Tensor` constructor as reference types are not allowed. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

CVE-2022-23588 is a medium-severity vulnerability affecting multiple versions of TensorFlow, an open-source machine learning framework widely used for developing and deploying machine learning models. The vulnerability arises from a reachable assertion failure (CWE-617) within TensorFlow's Grappler optimizer component. Specifically, a malicious actor can craft a specially altered SavedModel file such that when TensorFlow attempts to optimize the model graph, Grappler tries to build a tensor using a reference data type (dtype). Reference types are not permitted in this context, causing a CHECK-fail assertion in the Tensor constructor, which leads to a crash of the TensorFlow process. This effectively results in a denial of service (DoS) condition. The affected versions include TensorFlow versions 2.5.3 and earlier, 2.6.0 up to but not including 2.6.3, and 2.7.0 up to but not including 2.7.1. The issue was addressed in TensorFlow 2.8.0, with backported fixes for versions 2.5.3, 2.6.3, and 2.7.1. No known exploits have been reported in the wild to date. The vulnerability requires the attacker to supply a malicious SavedModel file to the TensorFlow environment, which means exploitation requires some level of interaction or input of crafted data. The impact is primarily a denial of service due to process crash rather than remote code execution or data compromise. The vulnerability affects the integrity and availability of the TensorFlow service but does not directly expose confidentiality risks. The root cause is a lack of validation preventing the use of invalid reference types during tensor construction in the optimization phase.

Detailed information about CVE-2022-23588: CWE-617: Reachable Assertion in tensorflow tensorflow affecting tensorflow tensorflow. Get real-time updates, technic

CVE-2022-23588: CWE-617: Reachable Assertion in tensorflow tensorflow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-23588: CWE-617: Reachable Assertion in tensorflow tensorflow

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that assertions in `function.cc` would be falsified and crash the Python interpreter. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

CVE-2022-23586 is a vulnerability identified in TensorFlow, an open-source machine learning framework widely used for developing and deploying machine learning models. The issue is classified under CWE-617, which refers to a reachable assertion vulnerability. Specifically, a malicious actor can craft a specially altered SavedModel file that triggers assertion failures within TensorFlow's function.cc source code. When such an assertion is falsified, it causes the Python interpreter running TensorFlow to crash, resulting in a denial of service (DoS) condition. This vulnerability affects multiple TensorFlow versions: all versions prior to 2.5.3, versions from 2.6.0 up to but not including 2.6.3, and versions from 2.7.0 up to but not including 2.7.1. The issue is addressed in TensorFlow 2.8.0 and backported patches are planned for 2.5.3, 2.6.3, and 2.7.1. The vulnerability does not require authentication or elevated privileges to exploit, but it does require the ability to supply a malicious SavedModel to the TensorFlow environment. There are no known exploits in the wild at this time. The impact is primarily a denial of service through crashing the Python interpreter, which can disrupt machine learning workflows and services relying on TensorFlow models. The vulnerability does not appear to allow code execution or data leakage directly, but the interruption of service can have significant operational consequences in production environments.

Detailed information about CVE-2022-23586: CWE-617: Reachable Assertion in tensorflow tensorflow affecting tensorflow tensorflow. Get real-time updates, technic

CVE-2022-23586: CWE-617: Reachable Assertion in tensorflow tensorflow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-23586: CWE-617: Reachable Assertion in tensorflow tensorflow

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that any binary op would trigger `CHECK` failures. This occurs when the protobuf part corresponding to the tensor arguments is modified such that the `dtype` no longer matches the `dtype` expected by the op. In that case, calling the templated binary operator for the binary op would receive corrupted data, due to the type confusion involved. If `Tin` and `Tout` don't match the type of data in `out` and `input_*` tensors then `flat<*>` would interpret it wrongly. In most cases, this would be a silent failure, but we have noticed scenarios where this results in a `CHECK` crash, hence a denial of service. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

CVE-2022-23583 is a medium severity vulnerability affecting TensorFlow, an open-source machine learning framework widely used for developing and deploying machine learning models. The vulnerability arises from a reachable assertion failure (CWE-617) caused by type confusion in the handling of tensor data types within TensorFlow's SavedModel format. Specifically, a malicious actor can craft or alter a SavedModel protobuf such that the data type (`dtype`) of tensor arguments does not match the expected data type for a binary operation (binary op). When TensorFlow attempts to execute this binary operation, the templated binary operator receives corrupted data due to this type mismatch. This leads to incorrect interpretation of tensor data by the `flat<*>` accessor, which can cause a `CHECK` assertion failure in the TensorFlow runtime. The assertion failure results in a denial of service (DoS) by crashing the TensorFlow process. This vulnerability affects TensorFlow versions 2.5.3 and earlier, as well as versions 2.6.0 up to but not including 2.6.3, and versions 2.7.0 up to but not including 2.7.1. The issue is addressed in TensorFlow 2.8.0 and backported to supported earlier versions. No known exploits have been reported in the wild. The vulnerability requires a maliciously crafted SavedModel to be loaded and executed, which implies some level of user interaction or model ingestion by the target system. The impact is primarily denial of service, as the corrupted model causes the TensorFlow runtime to crash due to failed internal consistency checks. Confidentiality and integrity of data are not directly impacted by this vulnerability, but availability of TensorFlow-based services can be disrupted.

Detailed information about CVE-2022-23583: CWE-617: Reachable Assertion in tensorflow tensorflow affecting tensorflow tensorflow. Get real-time updates, technic

CVE-2022-23583: CWE-617: Reachable Assertion in tensorflow tensorflow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-23583: CWE-617: Reachable Assertion in tensorflow tensorflow

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that `TensorByteSize` would trigger `CHECK` failures. `TensorShape` constructor throws a `CHECK`-fail if shape is partial or has a number of elements that would overflow the size of an `int`. The `PartialTensorShape` constructor instead does not cause a `CHECK`-abort if the shape is partial, which is exactly what this function needs to be able to return `-1`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

CVE-2022-23582 is a medium-severity vulnerability in TensorFlow, an open-source machine learning framework widely used for developing and deploying machine learning models. The vulnerability arises from a reachable assertion failure (CWE-617) triggered by specially crafted SavedModel files. Specifically, the issue occurs when a malicious user alters a SavedModel such that the TensorByteSize calculation triggers CHECK failures. The root cause lies in the TensorShape constructor, which performs CHECK assertions that abort execution if the shape is partial or if the number of elements would overflow the size of an integer. In contrast, the PartialTensorShape constructor does not abort on partial shapes, allowing it to return -1 safely. An attacker can exploit this inconsistency by providing a malformed SavedModel with partial or oversized tensor shapes, causing the TensorFlow process to abort unexpectedly, resulting in a denial of service (DoS). This vulnerability affects TensorFlow versions >= 2.7.0 and < 2.7.1, >= 2.6.0 and < 2.6.3, and all versions below 2.5.3. The issue was addressed in TensorFlow 2.8.0, with backported fixes for 2.7.1, 2.6.3, and 2.5.3. No known exploits have been reported in the wild. The vulnerability requires the attacker to supply a malicious SavedModel file, which implies some level of user interaction or input acceptance by the vulnerable system. The impact is limited to denial of service, as the assertion failure causes the TensorFlow process to terminate unexpectedly, potentially disrupting machine learning workflows or services relying on TensorFlow for inference or training.

Detailed information about CVE-2022-23582: CWE-617: Reachable Assertion in tensorflow tensorflow affecting tensorflow tensorflow. Get real-time updates, technic

CVE-2022-23582: CWE-617: Reachable Assertion in tensorflow tensorflow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-23582: CWE-617: Reachable Assertion in tensorflow tensorflow

Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `IsSimplifiableReshape` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

CVE-2022-23581 is a medium-severity vulnerability affecting multiple versions of TensorFlow, an open-source machine learning framework widely used for developing and deploying machine learning models. The vulnerability resides in the Grappler optimizer component of TensorFlow, specifically related to the handling of SavedModel files. An attacker can craft a malicious SavedModel that triggers the IsSimplifiableReshape function to cause assertion failures (CHECK failures) within the TensorFlow runtime. This results in a reachable assertion vulnerability (CWE-617), which can lead to a denial of service (DoS) by crashing the TensorFlow process. The issue affects TensorFlow versions 2.5.3 and earlier, 2.6.0 up to but not including 2.6.3, and 2.7.0 up to but not including 2.7.1. The vulnerability does not require authentication or user interaction but does require the processing of a specifically crafted SavedModel file, which could be introduced through model deployment or ingestion pipelines. The fix for this vulnerability has been incorporated starting with TensorFlow 2.8.0, and backported patches are planned for the affected supported versions. There are no known exploits in the wild at the time of reporting, but the vulnerability presents a risk to systems that automatically load or optimize untrusted or user-supplied TensorFlow models. The impact is primarily denial of service, which can disrupt machine learning workflows, model serving, or inference services relying on TensorFlow. This vulnerability highlights the importance of validating and sanitizing machine learning model inputs and ensuring that TensorFlow installations are kept up to date with security patches.

Detailed information about CVE-2022-23581: CWE-617: Reachable Assertion in tensorflow tensorflow affecting tensorflow tensorflow. Get real-time updates, technic

CVE-2022-23581: CWE-617: Reachable Assertion in tensorflow tensorflow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-23581: CWE-617: Reachable Assertion in tensorflow tensorflow

Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `SafeToRemoveIdentity` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

CVE-2022-23579 is a medium-severity vulnerability affecting multiple versions of TensorFlow, an open-source machine learning framework widely used for developing and deploying machine learning models. The vulnerability resides in the Grappler optimizer component of TensorFlow, specifically related to the handling of the SavedModel format. An attacker can craft or alter a SavedModel such that the SafeToRemoveIdentity function triggers a CHECK failure, which is an assertion designed to verify internal assumptions during execution. This reachable assertion failure leads to a denial of service (DoS) condition by crashing the TensorFlow process. The affected versions include TensorFlow 2.5.0 up to but not including 2.5.3, 2.6.0 up to but not including 2.6.3, and 2.7.0 up to but not including 2.7.1. The issue is addressed in TensorFlow 2.8.0 and backported patches for 2.7.1, 2.6.3, and 2.5.3. No known exploits have been reported in the wild to date. The vulnerability is classified under CWE-617 (Reachable Assertion), indicating that an assertion failure can be triggered by crafted input, causing the program to terminate unexpectedly. The attack vector requires supplying a malicious SavedModel to the TensorFlow environment, which may occur during model loading or optimization phases. Since TensorFlow is often integrated into larger systems and services, a denial of service could disrupt machine learning workflows, model serving, or automated pipelines relying on TensorFlow. The vulnerability does not require authentication or user interaction beyond providing the malicious model input. Exploitation is relatively straightforward for an attacker with the ability to supply or influence the model input to the TensorFlow system.

Detailed information about CVE-2022-23579: CWE-617: Reachable Assertion in tensorflow tensorflow affecting tensorflow tensorflow. Get real-time updates, technic

CVE-2022-23579: CWE-617: Reachable Assertion in tensorflow tensorflow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-23579: CWE-617: Reachable Assertion in tensorflow tensorflow

TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit f3f9cb38ecfe5a8a703f2c4a8fead434ef291713. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

CVE-2022-36026 is a vulnerability identified in TensorFlow, an open-source machine learning platform widely used for developing and deploying machine learning models. The flaw arises in the `QuantizeAndDequantizeV3` operation, which is responsible for quantization and dequantization of tensors during model processing. Specifically, if the `num_bits` input tensor to this operation is provided as a nonscalar (i.e., a tensor with more than one element or dimensions rather than a single scalar value), it triggers a `CHECK` failure within TensorFlow's internal assertion mechanisms. This failure leads to a reachable assertion error (CWE-617), causing the TensorFlow process to crash, effectively resulting in a denial of service (DoS) condition. The vulnerability affects multiple TensorFlow versions: all versions prior to 2.7.2, versions 2.8.0 up to but not including 2.8.1, and versions 2.9.0 up to but not including 2.9.1. The issue was patched in commit f3f9cb38ecfe5a8a703f2c4a8fead434ef291713 and incorporated into TensorFlow 2.10.0, with backports planned for 2.9.1, 2.8.1, and 2.7.2. There are no known workarounds, and no exploits have been reported in the wild to date. The vulnerability requires an attacker to supply malformed input data to the TensorFlow process, but does not require authentication or user interaction beyond the processing of crafted inputs. The impact is limited to denial of service, as no code execution or data leakage has been reported. This vulnerability is primarily a stability and availability concern for systems running vulnerable TensorFlow versions, especially those exposed to untrusted input data streams or APIs that process machine learning models dynamically.

Detailed information about CVE-2022-36026: CWE-617: Reachable Assertion in tensorflow tensorflow affecting tensorflow tensorflow. Get real-time updates, technic

CVE-2022-36026: CWE-617: Reachable Assertion in tensorflow tensorflow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-36026: CWE-617: Reachable Assertion in tensorflow tensorflow

TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

CVE-2022-36019 is a medium-severity vulnerability identified in TensorFlow, an open-source machine learning platform widely used for developing and deploying machine learning models. The vulnerability arises from a reachable assertion failure (CWE-617) within the FakeQuantWithMinMaxVarsPerChannel operation. Specifically, when the 'min' or 'max' tensors provided to this operation have a rank other than one, an internal CHECK assertion fails, causing the TensorFlow process to terminate unexpectedly. This results in a denial of service (DoS) condition. The issue affects TensorFlow versions prior to 2.7.2, versions 2.8.0 up to but not including 2.8.1, and versions 2.9.0 up to but not including 2.9.1. The vulnerability was patched in commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0, with fixes backported to supported versions 2.7.2, 2.8.1, and 2.9.1. There are no known workarounds, and no exploits have been reported in the wild. The vulnerability requires that an attacker supply malformed input tensors to trigger the assertion failure, which implies that the attacker must have the ability to influence the input data to the affected TensorFlow operation. The impact is limited to denial of service through process termination, with no direct indication of confidentiality or integrity compromise. The vulnerability does not require authentication but does require user interaction in the form of feeding crafted input data to the TensorFlow model or system using the vulnerable operation.

Detailed information about CVE-2022-36019: CWE-617: Reachable Assertion in tensorflow tensorflow affecting tensorflow tensorflow. Get real-time updates, technic

CVE-2022-36019: CWE-617: Reachable Assertion in tensorflow tensorflow - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-36019: CWE-617: Reachable Assertion in tensorflow tensorflow

TensorFlow is an open source platform for machine learning. If `RaggedTensorToVariant` is given a `rt_nested_splits` list that contains tensors of ranks other than one, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 88f93dfe691563baa4ae1e80ccde2d5c7a143821. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

CVE-2022-36018 is a medium-severity vulnerability affecting TensorFlow, an open-source machine learning platform widely used for developing and deploying machine learning models. The vulnerability arises from a reachable assertion failure (CWE-617) in the function RaggedTensorToVariant. Specifically, if the input parameter `rt_nested_splits` contains tensors with ranks other than one, the system triggers a CHECK failure, causing the TensorFlow process to crash. This behavior can be exploited by an attacker to cause a denial of service (DoS) condition by providing malformed input data to the affected TensorFlow versions. The affected versions include all releases prior to 2.7.2, versions 2.8.0 up to but not including 2.8.1, and versions 2.9.0 up to but not including 2.9.1. The issue was patched in commit 88f93dfe691563baa4ae1e80ccde2d5c7a143821 and incorporated into TensorFlow 2.10.0, with backports to 2.7.2, 2.8.1, and 2.9.1. There are currently no known workarounds, and no exploits have been observed in the wild. The vulnerability does not require authentication or user interaction but does require the attacker to supply crafted input to the TensorFlow API or system using the vulnerable function. The impact is limited to denial of service through process termination, with no indication of code execution or data corruption. This vulnerability is primarily a stability and availability concern for systems running affected TensorFlow versions, especially those exposed to untrusted input data streams or APIs that process machine learning data dynamically.

Detailed information about CVE-2022-36018: CWE-617: Reachable Assertion in tensorflow tensorflow affecting tensorflow tensorflow. Get real-time updates, technic

Title	Severity	Type	Source	Date

Threats Tagged 'cwe-617-reachable-assertion'

Filter Threats

Threats Tagged 'cwe-617-reachable-assertion'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility