CVE-2022-29209: Type confusion leading to `CHECK`-failure based denial of service in TensorFlow
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., CHECKLT, CHECKGT, etc.) have an incorrect logic when comparing sizet and int values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.9.0 - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.8.1 - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.7.2 - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.6.4
Event History
Frequently Asked Questions
Is CVE-2022-29209 specific to a certain platform or environment?
CVE-2022-29209 is specific to the TensorFlow library and affects any environment using the vulnerable versions.