CVE-2022-29207: Undefined behavior when users supply invalid resource handles in TensorFlow
First published: Fri May 20 2022(Updated: )
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TensorFlow Keras | <2.6.4 | |
| TensorFlow Keras | >=2.7.0<2.7.2 | |
| TensorFlow Keras | =2.7.0-rc0 | |
| TensorFlow Keras | =2.7.0-rc1 | |
| TensorFlow Keras | =2.8.0 | |
| TensorFlow Keras | =2.8.0-rc0 | |
| TensorFlow Keras | =2.8.0-rc1 | |
| TensorFlow Keras | =2.9.0-rc0 | |
| TensorFlow Keras | =2.9.0-rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/tensorflow/tensorflow/commit/a5b89cd68c02329d793356bda85d079e9e69b4e7
- https://github.com/tensorflow/tensorflow/commit/dbdd98c37bc25249e8f288bd30d01e118a7b4498
- https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
- https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2
- https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1
- https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5wpj-c6f7-24x8
Frequently Asked Questions
What is the severity of CVE-2022-29207?
CVE-2022-29207 is considered a medium severity vulnerability affecting TensorFlow operations due to improper handling of invalid resource handles.
How do I fix CVE-2022-29207?
To fix CVE-2022-29207, upgrade to TensorFlow versions 2.6.4, 2.7.2, 2.8.1, or 2.9.0 or later.
Which versions of TensorFlow are affected by CVE-2022-29207?
CVE-2022-29207 affects TensorFlow versions prior to 2.6.4, including versions 2.6.0 to 2.8.0.
What type of attacks can CVE-2022-29207 lead to?
CVE-2022-29207 may lead to unexpected behavior or crashes in applications utilizing TensorFlow.
Is CVE-2022-29207 a critical vulnerability?
No, CVE-2022-29207 is not classified as a critical vulnerability, but it still poses potential risks if left unaddressed.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/author
- agent/references
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/google
- canonical/tensorflow keras
- version/tensorflow keras/2.7.0
- version/tensorflow keras/2.7.0-rc0
- version/tensorflow keras/2.7.0-rc1
- version/tensorflow keras/2.8.0
- version/tensorflow keras/2.8.0-rc0
- version/tensorflow keras/2.8.0-rc1
- version/tensorflow keras/2.9.0-rc0
- version/tensorflow keras/2.9.0-rc1