CVE-2022-29199: Missing validation causes denial of service in TensorFlow via `LoadAndRemapMatrix`
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. The code assumes initializingvalues is a vector but there is no validation for this before accessing its value. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29199?
CVE-2022-29199 has a severity rating that indicates a potential denial of service vulnerability in TensorFlow.
How do I fix CVE-2022-29199?
To fix CVE-2022-29199, upgrade TensorFlow to version 2.9.0 or later, or to 2.8.1, 2.7.2, or 2.6.4.
Which versions of TensorFlow are affected by CVE-2022-29199?
CVE-2022-29199 affects TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4.
What component of TensorFlow is vulnerable in CVE-2022-29199?
The vulnerability in CVE-2022-29199 is found in the `tf.raw_ops.LoadAndRemapMatrix` implementation.
Can CVE-2022-29199 cause data loss?
CVE-2022-29199 primarily poses a risk of denial of service, but it does not specifically indicate potential data loss.