CVE-2022-29216

TensorFlow saved_model_cli code injection

• CVSS 7.8
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• Input Validation and Sanitization
• Remote

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, TensorFlow's `saved_model_cli` tool is vulnerable to a code injection. This can be used to open a reverse shell. This code path was maintained for compatibility reasons as the maintainers had several test cases where numpy expressions were used as arguments. However, given that the tool is always run manually, the impact of this is still not severe. The maintainers have now removed the `safe=False` argument, so all parsing is done without calling `eval`. The patch is available in versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4.

CVE

CVE-2022-29216

CWE

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSS base score

7.8

Published

2022-05-21

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

TensorFlow

Fixed by upgrading

Yes

Solution

Update TensorFlow to version 2.9.0, 2.8.1, 2.7.2, or 2.6.4.

import tensorflow as tf

def load_model(model_path):
    model = tf.saved_model.load(model_path)
    return model

model_path = "path/to/saved_model"
model = load_model(model_path)

import tensorflow as tf
import os

def load_model(model_path):
    allowed_dir = "/models/"
    
    if not model_path.startswith(allowed_dir):
        raise ValueError("Untrusted model path detected!")

    if not os.path.isdir(model_path):
        raise ValueError("Invalid model directory!")

    model = tf.saved_model.load(model_path)
    return model

model_path = "path/to/saved_model"
model = load_model(model_path)

@misc{vaitp:cve202229216,
  title        = {{TensorFlow saved_model_cli code injection}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-29216},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-29216/}}
}