CVE-2022-29213: Incomplete validation in signal ops leads to crashes in TensorFlow
Impact The tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes (due to CHECK-failures).
Patches We have patched the issue in GitHub commit 0a8a781e597b18ead006d19b7d23d0a369e9ad73 (merging GitHub PR #55274).
The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported externally via a GitHub issue.
Other sources
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes (due to CHECK-failures). Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What versions are affected by CVE-2022-29213?
CVE-2022-29213 affects TensorFlow versions from 2.6.0 to 2.8.0.
What is the impact of CVE-2022-29213?
CVE-2022-29213 can lead to crashes in applications using tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d due to lack of input validation.
How do I fix CVE-2022-29213?
To fix CVE-2022-29213, upgrade TensorFlow to version 2.8.1 or later.
Is CVE-2022-29213 a critical vulnerability?
CVE-2022-29213 is categorized as a vulnerability that can cause application crashes, indicating a moderate risk.
Where can I find more information about CVE-2022-29213?
For more detailed information on CVE-2022-29213, you can refer to the advisory on GitHub.