id: PYSEC-2022-79
details: Tensorflow is an Open Source Machine Learning Framework. When decoding a
  tensor from protobuf, TensorFlow might do a null-dereference if attributes of some
  mutable arguments to some operations are missing from the proto. This is guarded
  by a `DCHECK`. However, `DCHECK` is a no-op in production builds and an assertion
  failure in debug builds. In the first case execution proceeds to the dereferencing
  of the null pointer, whereas in the second case it results in a crash due to the
  assertion failure. The fix will be included in TensorFlow 2.8.0. We will also cherrypick
  this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected
  and still in supported range.
affected:
- package:
    name: tensorflow-cpu
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow-cpu
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: 8a513cec4bec15961fbfdedcaa5376522980455c
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.5.3
    - introduced: 2.6.0
    - fixed: 2.6.3
  versions:
  - 1.15.0
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.6.0
  - 2.6.1
  - 2.6.2
references:
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/8a513cec4bec15961fbfdedcaa5376522980455c
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9p77-mmrw-69c7
- type: WEB
  url: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L104-L106
aliases:
- CVE-2022-23570
- GHSA-9p77-mmrw-69c7
modified: "2022-03-09T00:17:33.672987Z"
published: "2022-02-04T23:15:00Z"