CVE-2022-29194: Missing validation causes denial of service via `DeleteSessionTensor` in TensorFlow
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.DeleteSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29194?
CVE-2022-29194 is classified as a high severity vulnerability due to its potential to trigger denial of service attacks.
How do I fix CVE-2022-29194?
To patch CVE-2022-29194, upgrade TensorFlow to versions 2.9.0, 2.8.1, 2.7.2, or 2.6.4 or later.
What versions of TensorFlow are affected by CVE-2022-29194?
CVE-2022-29194 affects TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4.
What type of issue does CVE-2022-29194 represent?
CVE-2022-29194 represents a validation issue in the input arguments of tf.raw_ops.DeleteSessionTensor.
Can CVE-2022-29194 be exploited remotely?
Yes, CVE-2022-29194 can potentially be exploited remotely to cause a denial of service.