CVE-2022-29212: Core dump when loading TFLite models with quantization in TensorFlow
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling QuantizeMultiplierSmallerThanOneExp, the TFLITECHECKLT assertion would trigger and abort the process. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-29212?
CVE-2022-29212 has a medium severity level as it can cause certain TFLite models to crash during runtime.
How do I fix CVE-2022-29212?
To fix CVE-2022-29212, you should update TensorFlow to version 2.9.0 or later, or any of the specified fixed versions.
Which versions of TensorFlow are affected by CVE-2022-29212?
CVE-2022-29212 affects TensorFlow versions prior to 2.6.4, 2.7.2, 2.8.1, and 2.9.0.
What types of models are impacted by CVE-2022-29212?
CVE-2022-29212 impacts certain TFLite models created using the TFLite model converter.
Is CVE-2022-29212 a remote code execution vulnerability?
No, CVE-2022-29212 is not a remote code execution vulnerability; it specifically causes a crash in the TFLite interpreter.