FreeBSD : py-tflite -- buffer overflow vulnerability (326b2f3e-6fc7-4661-955d-a772760db9cf)

high Nessus Plugin ID 174295

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 326b2f3e-6fc7-4661-955d-a772760db9cf advisory.

- TensorFlow is an open source platform for machine learning. The reference kernel of the `CONV_3D_TRANSPOSE` TensorFlow Lite operator wrongly increments the data_ptr when adding the bias to the result. Instead of `data_ptr += num_channels;` it should be `data_ptr += output_num_channels;` as if the number of input channels is different than the number of output channels, the wrong result will be returned and a buffer overflow will occur if num_channels > output_num_channels. An attacker can craft a model with a specific number of input channels. It is then possible to write specific values through the bias of the layer outside the bounds of the buffer. This attack only works if the reference kernel resolver is used in the interpreter. We have patched the issue in GitHub commit 72c0bdcb25305b0b36842d746cc61d72658d2941. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. (CVE-2022-41894)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 174295

File Name: freebsd_pkg_326b2f3e6fc74661955da772760db9cf.nasl

Version: 1.1

Type: local

Family: FreeBSD Local Security Checks

Published: 4/14/2023

Updated: 4/19/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2022-41894

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:py38-tflite, p-cpe:/a:freebsd:freebsd:py39-tflite, cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:py310-tflite, p-cpe:/a:freebsd:freebsd:py311-tflite, p-cpe:/a:freebsd:freebsd:py37-tflite

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/9/2023

Vulnerability Publication Date: 11/18/2022

Reference Information

CVE: CVE-2022-41894

Detections

Analytics