CVE-2022-29207: Undefined behavior when users supply invalid resource handles in TensorFlow
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29207?
CVE-2022-29207 is considered a medium severity vulnerability affecting TensorFlow operations due to improper handling of invalid resource handles.
How do I fix CVE-2022-29207?
To fix CVE-2022-29207, upgrade to TensorFlow versions 2.6.4, 2.7.2, 2.8.1, or 2.9.0 or later.
Which versions of TensorFlow are affected by CVE-2022-29207?
CVE-2022-29207 affects TensorFlow versions prior to 2.6.4, including versions 2.6.0 to 2.8.0.
What type of attacks can CVE-2022-29207 lead to?
CVE-2022-29207 may lead to unexpected behavior or crashes in applications utilizing TensorFlow.
Is CVE-2022-29207 a critical vulnerability?
No, CVE-2022-29207 is not classified as a critical vulnerability, but it still poses potential risks if left unaddressed.