CVE-2022-29195: Missing validation causes denial of service in TensorFlow via `StagePeek`
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.StagePeek does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. The code assumes index is a scalar but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29195?
CVE-2022-29195 has a severity level that can lead to denial of service due to input validation issues.
How do I fix CVE-2022-29195?
To fix CVE-2022-29195, upgrade TensorFlow to version 2.9.0, 2.8.1, 2.7.2, or 2.6.4 or later.
What versions of TensorFlow are affected by CVE-2022-29195?
CVE-2022-29195 affects TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4.
What is the cause of CVE-2022-29195?
CVE-2022-29195 is caused by insufficient validation of input arguments in the tf.raw_ops.StagePeek implementation.
Who is the vendor for CVE-2022-29195?
The vendor for CVE-2022-29195 is Google, as it pertains to their TensorFlow software.