CVE-2022-41899: Reachable Assertion (CWE-617)
value: TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaOptimizer`. We have patched the issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
CWE description: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CVSS v3 base score: 7.5
Published: 2022-11-18T22:15Z
Repository: https://github.com/tensorflow/tensorflow
Language: C++
Files changed: tensorflow/core/kernels/sdca_internal.cc, tensorflow/core/kernels/sdca_ops.cc
Commit date: 2022-09-30 14:02:00 -0700
Commit message: Fix SDCA optimizer crash.

Validates size of the dense_features and example state_data_inputs.
Other validation already verifies that sizes are otherwise consistent.

This looks to be a v1-only op that isn't used internally at all outside
of `contrib`, and no tests.

PiperOrigin-RevId: 478073762

Diff: diff --git a/tensorflow/core/kernels/sdca_internal.cc b/tensorflow/core/kernels/sdca_internal.cc
index 5572cb934e40c..79dc01baa4a03 100644
--- a/tensorflow/core/kernels/sdca_internal.cc
+++ b/tensorflow/core/kernels/sdca_internal.cc
@@ -387,10 +387,17 @@ Status Examples::Initialize(OpKernelContext* const context,
   }
 
   OpInputList dense_features_inputs;
   TF_RETURN_IF_ERROR(
       context->input_list("dense_features", &dense_features_inputs));
+  for (int i = 0; i < dense_features_inputs.size(); ++i) {
+    if (!TensorShapeUtils::IsMatrix(dense_features_inputs[i].shape())) {
+      return errors::InvalidArgument("Dense features at index ", i,
+                                     " must be rank 2 but is rank ",
+                                     dense_features_inputs[i].dims());
+    }
+  }
 
   examples_.clear();
   examples_.resize(num_examples);
   probabilities_.resize(num_examples);
   sampled_index_.resize(num_examples);
diff --git a/tensorflow/core/kernels/sdca_ops.cc b/tensorflow/core/kernels/sdca_ops.cc
index 98b4fd1c82b23..d279eda86e741 100644
--- a/tensorflow/core/kernels/sdca_ops.cc
+++ b/tensorflow/core/kernels/sdca_ops.cc
@@ -47,10 +47,11 @@ limitations under the License.
 #include "tensorflow/core/lib/core/coding.h"
 #include "tensorflow/core/lib/core/errors.h"
 #include "tensorflow/core/lib/core/status.h"
 #include "tensorflow/core/lib/core/stringpiece.h"
 #include "tensorflow/core/lib/gtl/inlined_vector.h"
+#include "tensorflow/core/platform/errors.h"
 #include "tensorflow/core/platform/fingerprint.h"
 #include "tensorflow/core/platform/macros.h"
 #include "tensorflow/core/platform/mutex.h"
 #include "tensorflow/core/platform/types.h"
 #include "tensorflow/core/util/work_sharder.h"
@@ -140,10 +141,14 @@ void DoCompute(const ComputeOptions& options, OpKernelContext* const context) {
                           options.num_dense_features));
 
   const Tensor* example_state_data_t;
   OP_REQUIRES_OK(context,
                  context->input("example_state_data", &example_state_data_t));
+  OP_REQUIRES(
+      context, TensorShapeUtils::IsMatrix(example_state_data_t->shape()),
+      errors::InvalidArgument("example_state_data must be rank 2 but is rank ",
+                              example_state_data_t->dims()));
   TensorShape expected_example_state_shape({examples.num_examples(), 4});
   OP_REQUIRES(context,
               example_state_data_t->shape() == expected_example_state_shape,
               errors::InvalidArgument(
                   "Expected shape ", expected_example_state_shape.DebugString(),

Fixed code:   for (int i = 0; i < dense_features_inputs.size(); ++i) {
    if (!TensorShapeUtils::IsMatrix(dense_features_inputs[i].shape())) {
      return errors::InvalidArgument("Dense features at index ", i,
                                     " must be rank 2 but is rank ",
                                     dense_features_inputs[i].dims());
    }
  }
#include "tensorflow/core/platform/errors.h"
  OP_REQUIRES(
      context, TensorShapeUtils::IsMatrix(example_state_data_t->shape()),
      errors::InvalidArgument("example_state_data must be rank 2 but is rank ",
                              example_state_data_t->dims()));