CVE-2022-35939: Out of bounds write in `scatter_nd` op in TensorFlow Lite
TensorFlow is an open source platform for machine learning. The ScatterNd function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. We have patched the issue in GitHub commit b4d4b4cb019bd7240a52daa4ba61e3cc814f0384. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-35939?
The severity of CVE-2022-35939 is classified as high due to potential improper memory access.
How does CVE-2022-35939 affect TensorFlow?
CVE-2022-35939 can cause out-of-bounds memory access when using the ScatterNd function with invalid indices.
How do I fix CVE-2022-35939?
To fix CVE-2022-35939, upgrade to TensorFlow version 2.10 or later.
Which versions of TensorFlow are affected by CVE-2022-35939?
CVE-2022-35939 affects TensorFlow versions from 2.7.0 to 2.9.1, including specific release candidates.
What is the nature of the vulnerability in CVE-2022-35939?
CVE-2022-35939 involves improper handling of input indices in the ScatterNd function, leading to potential data corruption.