CVE-2022-29191: Missing validation causes denial of service via `GetSessionTensor` in TensorFlow
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.GetSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29191?
CVE-2022-29191 has been classified as a medium severity vulnerability due to its potential to trigger denial of service.
How do I fix CVE-2022-29191?
To fix CVE-2022-29191, upgrade TensorFlow to version 2.9.0 or later, or to approved patches like 2.8.1, 2.7.2, or 2.6.4.
What versions of TensorFlow are affected by CVE-2022-29191?
CVE-2022-29191 affects TensorFlow versions prior to 2.6.4, including 2.7.0 through 2.7.2, and 2.8.0 through 2.8.1.
What is the cause of CVE-2022-29191?
CVE-2022-29191 is caused by insufficient input argument validation in the implementation of the 'tf.raw_ops.GetSessionTensor' operation.
Is CVE-2022-29191 a remote vulnerability?
CVE-2022-29191 does not appear to be a remote vulnerability, as it requires local execution to exploit.