CVE-2022-29192: Missing validation crashes `QuantizeAndDequantizeV4Grad` in TensorFlow
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29192?
CVE-2022-29192 is classified as a medium severity vulnerability due to its potential to cause application crashes.
How do I fix CVE-2022-29192?
To fix CVE-2022-29192, upgrade TensorFlow to version 2.9.0 or later, or to version 2.8.1, 2.7.2, or 2.6.4.
What versions of TensorFlow are affected by CVE-2022-29192?
CVE-2022-29192 affects TensorFlow versions prior to 2.6.4, 2.7.2, 2.8.1, and any version of 2.9.0 prior to its release candidates.
What kind of attack vector does CVE-2022-29192 present?
CVE-2022-29192 allows an attacker to exploit the vulnerability by passing invalid input arguments that cause a CHECK failure.
Is CVE-2022-29192 related to data handling in TensorFlow?
Yes, CVE-2022-29192 is related to how TensorFlow handles input validation for the QuantizeAndDequantizeV4Grad operation.