CVE-2022-35968: `CHECK` fail in `AvgPoolGrad` in TensorFlow
TensorFlow is an open source platform for machine learning. The implementation of AvgPoolGrad does not fully validate the input originputshape. This results in a CHECK failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 3a6ac52664c6c095aa2b114e742b0aa17fdce78f. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-35968?
CVE-2022-35968 has a severity rating that indicates it can lead to denial of service due to a CHECK failure in TensorFlow's AvgPoolGrad implementation.
How do I fix CVE-2022-35968?
To fix CVE-2022-35968, update your TensorFlow installation to a version that includes the patch released in response to this vulnerability.
What versions of TensorFlow are affected by CVE-2022-35968?
CVE-2022-35968 affects TensorFlow versions between 2.7.0 and 2.7.2, as well as 2.8.0 to 2.8.1, 2.9.0 to 2.9.1, and specific release candidates for 2.10.
Can CVE-2022-35968 be exploited remotely?
Yes, CVE-2022-35968 can potentially be exploited remotely, triggering a denial of service if the input is not properly validated.
What component of TensorFlow is impacted by CVE-2022-35968?
CVE-2022-35968 specifically impacts the AvgPoolGrad function in TensorFlow.