CVE-2022-29209: Type confusion leading to `CHECK`-failure based denial of service in TensorFlow
Published May 20, 2022
·Updated
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., CHECKLT, CHECKGT, etc.) have an incorrect logic when comparing sizet and int values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
9 affected components
Google TensorFlow<2.6.4
Google TensorFlow>=2.7.0<2.7.2
Google TensorFlow=2.7.0-rc0
Google TensorFlow=2.7.0-rc1
Google TensorFlow=2.8.0
Google TensorFlow=2.8.0-rc0
Google TensorFlow=2.8.0-rc1
Google TensorFlow=2.9.0-rc0
Google TensorFlow=2.9.0-rc1
Remediation
Patch Available
Event History
May 20, 2022
CVE Published
via MITRE·11:25 PM
Data Sourced
via MITRE·11:25 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Is CVE-2022-29209 specific to a certain platform or environment?
CVE-2022-29209 is specific to the TensorFlow library and affects any environment using the vulnerable versions.