CVE-2022-29206: Missing validation results in undefined behavior in `SparseTensorDenseAdd` in TensorFlow
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.SparseTensorDenseAdd does not fully validate the input arguments. In this case, a reference gets bound to a nullptr during kernel execution. This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29206?
The severity of CVE-2022-29206 is considered medium, primarily due to potential memory references being bound to null pointers.
How do I fix CVE-2022-29206?
To fix CVE-2022-29206, upgrade TensorFlow to versions 2.9.0, 2.8.1, 2.7.2, or 2.6.4 or later.
What versions of TensorFlow are affected by CVE-2022-29206?
CVE-2022-29206 affects TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4.
What is the impact of CVE-2022-29206 on applications using TensorFlow?
The impact of CVE-2022-29206 could lead to potential crashes or unexpected behavior in applications that misuse the SparseTensorDenseAdd operation.
Is CVE-2022-29206 a remote execution vulnerability?
CVE-2022-29206 is not classified as a remote execution vulnerability; it primarily affects local execution of TensorFlow operations.