CVE-2022-23594

TensorFlow TFG (MLIR) GraphDef conversion to MLIR can crash Python interpreter, leading to potential heap OOB read/writes

• CVSS 5.5
• CWE-125 Out-of-bounds Read
• Memory Corruption
• Remote

Tensorflow is an Open Source Machine Learning Framework. The TFG dialect of TensorFlow (MLIR) makes several assumptions about the incoming `GraphDef` before converting it to the MLIR-based dialect. If an attacker changes the `SavedModel` format on disk to invalidate these assumptions and the `GraphDef` is then converted to MLIR-based IR then they can cause a crash in the Python interpreter. Under certain scenarios, heap OOB read/writes are possible. These issues have been discovered via fuzzing and it is possible that more weaknesses exist. We will patch them as they are discovered.

CVE

CVE-2022-23594

CWE

CWE-125 Out-of-bounds Read

CVSS base score

5.5

Published

2022-02-04

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Memory Corruption

Subcategory

Out-of-Bound Accesses

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Affected component

TensorFlow

Fixed by upgrading

Yes

Solution

Update TensorFlow to the latest version.

import tensorflow as tf

def load_model(model_path):
    model = tf.saved_model.load(model_path)
    
    mlir_ir = tf.experimental.mlir.convert_to_mlir(model)
    
    return mlir_ir

model_path = "path/to/saved_model"
mlir_ir = load_model(model_path)

import tensorflow as tf

def load_model(model_path):
    try:
        model = tf.saved_model.load(model_path)

        if not model.signatures:
            raise ValueError("Model does not contain any valid signatures.")

        mlir_ir = tf.experimental.mlir.convert_to_mlir(model)

        return mlir_ir

    except Exception as e:
        print(f"[!] Error loading or converting the model: {e}")
        return None

model_path = "path/to/saved_model"
mlir_ir = load_model(model_path)

if mlir_ir is not None:
    print("[+] Model successfully converted to MLIR.")
else:
    print("[!] Model loading or conversion failed.")

import tensorflow as tf
import os
import shutil

# Create and save a simple model
model = tf.keras.Sequential([tf.keras.layers.Dense(1, input_shape=(1,))])
model.save("malicious_model", save_format="tf")

# Corrupt the model (e.g., remove a critical file)
shutil.rmtree("malicious_model/variables")  # Deletes variable data

@misc{vaitp:cve202223594,
  title        = {{TensorFlow TFG (MLIR) GraphDef conversion to MLIR can crash Python interpreter, leading to potential heap OOB read/writes}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-23594},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-23594/}}
}