`CHECK` failure in `SobolSample` via missing validation
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact Another instance of CVE-2022-35935, where `SobolSample` is vulnerable to a denial of service via assumed scalar inputs, was found and fixed. ```python import tensorflow as tf tf.raw_ops.SobolSample(dim=tf.constant([1,0]), num_results=tf.constant([1]), skip=tf.constant([1])) ``` ### Patches We have patched the issue in GitHub commits [c65c67f88ad770662e8f191269a907bf2b94b1bf](https://github.com/tensorflow/tensorflow/commit/c65c67f88ad770662e8f191269a907bf2b94b1bf) and [02400ea266bd811fc016a848445de1bbff3a23a0](https://github.com/tensorflow/tensorflow/commit/02400ea266bd811fc016a848445de1bbff3a23a0) The fix will be included in TensorFlow 2.11. We will also cherrypick both commits on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. TensorFlow 2.7.4 will have the first commit cherrypicked. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vulnerability has been reported by: - Kang Hong Jin from Singapore Management University - Neophytos Christou, Secure Systems Labs, Brown University - 刘力源, Information System & Security and Countermeasures Experiments Center, Beijing Institute of Technology - Pattarakrit Rattankul
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | tensorflow (PyPI) | before 2.8.4 | 2.8.4 | Patch available | GHSA-cqvq-fvhr-v6hc |
| — | tensorflow (PyPI) | 2.9.0 to before 2.9.3 | 2.9.3 | Patch available | GHSA-cqvq-fvhr-v6hc |
| — | tensorflow (PyPI) | 2.10.0 to before 2.10.1 | 2.10.1 | Patch available | GHSA-cqvq-fvhr-v6hc |
| — | tensorflow-cpu (PyPI) | before 2.8.4 | 2.8.4 | Patch available | GHSA-cqvq-fvhr-v6hc |
| — | tensorflow-gpu (PyPI) | before 2.8.4 | 2.8.4 | Patch available | GHSA-cqvq-fvhr-v6hc |
| — | tensorflow-cpu (PyPI) | 2.9.0 to before 2.9.3 | 2.9.3 | Patch available | GHSA-cqvq-fvhr-v6hc |
| — | tensorflow-gpu (PyPI) | 2.9.0 to before 2.9.3 | 2.9.3 | Patch available | GHSA-cqvq-fvhr-v6hc |
| — | tensorflow-cpu (PyPI) | 2.10.0 to before 2.10.1 | 2.10.1 | Patch available | GHSA-cqvq-fvhr-v6hc |
| — | tensorflow-gpu (PyPI) | 2.10.0 to before 2.10.1 | 2.10.1 | Patch available | GHSA-cqvq-fvhr-v6hc |
- tensorflow (PyPI) Vendor— Affected before 2.8.4 Fixed in 2.8.4 Patch available GHSA-cqvq-fvhr-v6hc
- tensorflow (PyPI) Vendor— Affected 2.9.0 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-cqvq-fvhr-v6hc
- tensorflow (PyPI) Vendor— Affected 2.10.0 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-cqvq-fvhr-v6hc
- tensorflow-cpu (PyPI) Vendor— Affected before 2.8.4 Fixed in 2.8.4 Patch available GHSA-cqvq-fvhr-v6hc
- tensorflow-gpu (PyPI) Vendor— Affected before 2.8.4 Fixed in 2.8.4 Patch available GHSA-cqvq-fvhr-v6hc
- tensorflow-cpu (PyPI) Vendor— Affected 2.9.0 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-cqvq-fvhr-v6hc
- tensorflow-gpu (PyPI) Vendor— Affected 2.9.0 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-cqvq-fvhr-v6hc
- tensorflow-cpu (PyPI) Vendor— Affected 2.10.0 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-cqvq-fvhr-v6hc
- tensorflow-gpu (PyPI) Vendor— Affected 2.10.0 to before 2.10.1 Fixed in 2.10.1 Patch available GHSA-cqvq-fvhr-v6hc
Remediation
- Fix · GHSA-cqvq-fvhr-v6hc tensorflow (PyPI) Fixed in 2.8.4 Advisory →
- Fix · GHSA-cqvq-fvhr-v6hc tensorflow (PyPI) Fixed in 2.9.3 Advisory →
- Fix · GHSA-cqvq-fvhr-v6hc tensorflow (PyPI) Fixed in 2.10.1 Advisory →
- Fix · GHSA-cqvq-fvhr-v6hc tensorflow-cpu (PyPI) Fixed in 2.8.4 Advisory →
- Fix · GHSA-cqvq-fvhr-v6hc tensorflow-gpu (PyPI) Fixed in 2.8.4 Advisory →
- Fix · GHSA-cqvq-fvhr-v6hc tensorflow-cpu (PyPI) Fixed in 2.9.3 Advisory →
- Fix · GHSA-cqvq-fvhr-v6hc tensorflow-gpu (PyPI) Fixed in 2.9.3 Advisory →
- Fix · GHSA-cqvq-fvhr-v6hc tensorflow-cpu (PyPI) Fixed in 2.10.1 Advisory →
- Fix · GHSA-cqvq-fvhr-v6hc tensorflow-gpu (PyPI) Fixed in 2.10.1 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-cqvq-fvhr-v6hc
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences