CVE-2022-21731: 
Python vulnerability analysis and mitigation

CVE-2022-21731 is a type confusion vulnerability in TensorFlow's shape inference implementation for ConcatV2 operation, discovered in February 2022. The vulnerability affects TensorFlow versions prior to 2.8.0, including versions 2.5.x, 2.6.x, and 2.7.x. This security flaw was reported by Yu Tian of Qihoo 360 AIVul Team (GitHub Advisory).

The vulnerability stems from a type confusion in the ConcatShapeHelper function where the axis argument is translated into concat_dim. The issue occurs when computing min_rank based on concat_dim, which is then used to validate the values tensor rank. While WithRankAtLeast receives the lower bound as a 64-bit value and compares it against the maximum 32-bit integer value, the min_rank is a 32-bit value. Due to the value of axis, the rank argument becomes negative, allowing the error check to be bypassed (GitHub Advisory). The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) (NVD).

When exploited, this vulnerability can trigger a denial of service attack through a segmentation fault caused by type confusion. The attack can be initiated by passing specific malicious input to the ConcatV2 operation (GitHub Advisory).

The vulnerability can be exploited by providing specific input to the ConcatV2 operation. A proof of concept exists that demonstrates the vulnerability using a TensorFlow function that calls ConcatV2 with carefully crafted values and axis parameters (GitHub Advisory).

The vulnerability has been patched in TensorFlow 2.8.0. Additionally, the fix has been backported to TensorFlow versions 2.7.1, 2.6.3, and 2.5.3. Users are advised to upgrade to these patched versions. The fix was implemented in GitHub commit 08d7b00c0a5a20926363849f611729f53f3ec022 (GitHub Commit, GitHub Advisory).