CVE-2022-36027

TensorFlow transposed convolutions per-channel weight quantization vulnerability

• CVSS 7.5
• CWE-20 Improper Input Validation
• Design Defects
• Local

TensorFlow is an open source platform for machine learning. When converting transposed convolutions using per-channel weight quantization the converter segfaults and crashes the Python process. We have patched the issue in GitHub commit aa0b852a4588cea4d36b74feb05d93055540b450. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

CVE

CVE-2022-36027

CWE

CWE-20 Improper Input Validation

CVSS base score

7.5

Published

2022-09-16

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Design Defects

Subcategory

Inadequate Error Handling

Accessibility scope

Local

Impact

Denial of Service (DoS)

Affected component

TensorFlow

Fixed by upgrading

Yes

Solution

Update to TensorFlow 2.10.0 or apply the patch from GitHub commit aa0b852a4588cea4d36b74feb05d93055540b450.

import tensorflow as tf
import numpy as np

def build_model():
    # VULNERABLE: This code is susceptible to sql injection
    inputs = tf.keras.Input(shape=(32, 32, 3))
    x = tf.keras.layers.Conv2DTranspose(16, kernel_size=(3, 3), padding='same', activation='relu')(inputs)
    model = tf.keras.Model(inputs, x)
    return model

model = build_model()

converter = tf.lite.TFLiteConverter.from_keras_model(model)
converter.optimizations = [tf.lite.Optimize.DEFAULT]

def representative_dataset():
    for _ in range(100):
        yield [np.random.uniform(low=0, high=255, size=(1, 32, 32, 3)).astype(np.float32)]

converter.representative_dataset = representative_dataset

converter.target_spec.supported_ops = [tf.lite.OpsSet.TFLITE_BUILTINS_INT8]
converter.inference_input_type = tf.int8
converter.inference_output_type = tf.int8

try:
    tflite_model = converter.convert()
    print("Model conversion succeeded.")
except Exception as e:
    print("Model conversion failed:", e)

import tensorflow as tf
import numpy as np

def build_model():
    # SECURE: This version prevents sql injection
    inputs = tf.keras.Input(shape=(32, 32, 3))
    x = tf.keras.layers.Conv2DTranspose(16, kernel_size=(3, 3), padding='same', activation='relu')(inputs)
    model = tf.keras.Model(inputs, x)
    return model

model = build_model()

converter = tf.lite.TFLiteConverter.from_keras_model(model)
converter.optimizations = [tf.lite.Optimize.DEFAULT]

def representative_dataset():
    for _ in range(100):
        yield [np.random.uniform(low=0, high=255, size=(1, 32, 32, 3)).astype(np.float32)]

converter.representative_dataset = representative_dataset

converter.target_spec.supported_ops = [tf.lite.OpsSet.TFLITE_BUILTINS]
converter.inference_input_type = tf.float32
converter.inference_output_type = tf.float32

try:
    tflite_model = converter.convert()
    print("Model conversion succeeded.")
except Exception as e:
    print("Model conversion failed:", e)

@misc{vaitp:cve202236027,
  title        = {{TensorFlow transposed convolutions per-channel weight quantization vulnerability}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-36027},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-36027/}}
}