CVE-2022-29201: Missing validation in `QuantizedConv2D` results in undefined behavior in TensorFlow
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.QuantizedConv2D does not fully validate the input arguments. In this case, references get bound to nullptr for each argument that is empty. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29201?
CVE-2022-29201 is classified as a moderate severity vulnerability.
How do I fix CVE-2022-29201?
To mitigate CVE-2022-29201, upgrade TensorFlow to version 2.9.0 or later.
What impact does CVE-2022-29201 have on TensorFlow applications?
CVE-2022-29201 can lead to null pointer dereferences, potentially causing application crashes.
Which versions of TensorFlow are affected by CVE-2022-29201?
CVE-2022-29201 affects TensorFlow versions prior to 2.6.4 as well as certain 2.7.x and 2.8.x releases.
Is there a known exploit for CVE-2022-29201?
As of now, there are no publicly reported exploits specifically for CVE-2022-29201.