TI-2022-26685 Aliases GHSA-xf83-q765-xm6m

`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in eager mode

LOW 38Published 2022-11-21 · Updated 2022-11-21

Key facts

Attack vector: —
Privileges required: —
User interaction: —
Attack complexity: —
Impact type: —
Confidentiality · integrity · availability: —
Fix status: Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact Another instance of CVE-2022-35991, where `TensorListScatter` and `TensorListScatterV2` crash via non scalar inputs in`element_shape`, was found in eager mode and fixed. ```python import tensorflow as tf arg_0=tf.random.uniform(shape=(2, 2, 2), dtype=tf.float16, maxval=None) arg_1=tf.random.uniform(shape=(2, 2, 2), dtype=tf.int32, maxval=65536) arg_2=tf.random.uniform(shape=(2, 2, 2), dtype=tf.int32, maxval=65536) arg_3='' tf.raw_ops.TensorListScatter(tensor=arg_0, indices=arg_1, element_shape=arg_2, name=arg_3) ``` ### Patches We have patched the issue in GitHub commit [bf9932fc907aff0e9e8cccf769e8b00d30fd81a1](https://github.com/tensorflow/tensorflow/commit/bf9932fc907aff0e9e8cccf769e8b00d30fd81a1). The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vulnerability has been reported by Pattarakrit Rattankul

Why it matters now

Fix Fixed tensorflow (PyPI): 2.8.4, 2.9.3, 2.10.1tensorflow-cpu (PyPI): 2.8.4, 2.9.3, 2.10.1+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	tensorflow (PyPI)	before 2.8.4	2.8.4	Patch available	GHSA-xf83-q765-xm6m
—	tensorflow (PyPI)	2.9.0 to before 2.9.3	2.9.3	Patch available	GHSA-xf83-q765-xm6m
—	tensorflow (PyPI)	2.10.0 to before 2.10.1	2.10.1	Patch available	GHSA-xf83-q765-xm6m
—	tensorflow-cpu (PyPI)	before 2.8.4	2.8.4	Patch available	GHSA-xf83-q765-xm6m
—	tensorflow-gpu (PyPI)	before 2.8.4	2.8.4	Patch available	GHSA-xf83-q765-xm6m
—	tensorflow-cpu (PyPI)	2.9.0 to before 2.9.3	2.9.3	Patch available	GHSA-xf83-q765-xm6m
—	tensorflow-gpu (PyPI)	2.9.0 to before 2.9.3	2.9.3	Patch available	GHSA-xf83-q765-xm6m
—	tensorflow-cpu (PyPI)	2.10.0 to before 2.10.1	2.10.1	Patch available	GHSA-xf83-q765-xm6m
—	tensorflow-gpu (PyPI)	2.10.0 to before 2.10.1	2.10.1	Patch available	GHSA-xf83-q765-xm6m

tensorflow (PyPI) Vendor— Affected before 2.8.4 Fixed in 2.8.4 Patch available GHSA-xf83-q765-xm6m
tensorflow (PyPI) Vendor— Affected 2.9.0 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-xf83-q765-xm6m
tensorflow (PyPI) Vendor— Affected 2.10.0 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-xf83-q765-xm6m
tensorflow-cpu (PyPI) Vendor— Affected before 2.8.4 Fixed in 2.8.4 Patch available GHSA-xf83-q765-xm6m
tensorflow-gpu (PyPI) Vendor— Affected before 2.8.4 Fixed in 2.8.4 Patch available GHSA-xf83-q765-xm6m
tensorflow-cpu (PyPI) Vendor— Affected 2.9.0 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-xf83-q765-xm6m
tensorflow-gpu (PyPI) Vendor— Affected 2.9.0 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-xf83-q765-xm6m
tensorflow-cpu (PyPI) Vendor— Affected 2.10.0 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-xf83-q765-xm6m
tensorflow-gpu (PyPI) Vendor— Affected 2.10.0 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-xf83-q765-xm6m

Remediation

Fix · GHSA-xf83-q765-xm6m tensorflow (PyPI) Fixed in 2.8.4 Advisory →
Fix · GHSA-xf83-q765-xm6m tensorflow (PyPI) Fixed in 2.9.3 Advisory →
Fix · GHSA-xf83-q765-xm6m tensorflow (PyPI) Fixed in 2.10.1 Advisory →
Fix · GHSA-xf83-q765-xm6m tensorflow-cpu (PyPI) Fixed in 2.8.4 Advisory →
Fix · GHSA-xf83-q765-xm6m tensorflow-gpu (PyPI) Fixed in 2.8.4 Advisory →
Fix · GHSA-xf83-q765-xm6m tensorflow-cpu (PyPI) Fixed in 2.9.3 Advisory →
Fix · GHSA-xf83-q765-xm6m tensorflow-gpu (PyPI) Fixed in 2.9.3 Advisory →
Fix · GHSA-xf83-q765-xm6m tensorflow-cpu (PyPI) Fixed in 2.10.1 Advisory →
Fix · GHSA-xf83-q765-xm6m tensorflow-gpu (PyPI) Fixed in 2.10.1 Advisory →

Timeline

2026-10-03 Threatist record created from GHSA-xf83-q765-xm6m

References

Other 2

Sources

GHSA-xf83-q765-xm6m · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences