CVE-2022-35969: `CHECK` fail in `Conv2DBackpropInput` in TensorFlow
TensorFlow is an open source platform for machine learning. The implementation of Conv2DBackpropInput requires inputsizes to be 4-dimensional. Otherwise, it gives a CHECK failure which can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 50156d547b9a1da0144d7babe665cf690305b33c. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-35969?
CVE-2022-35969 is considered a denial of service vulnerability, which can lead to application crashes.
How do I fix CVE-2022-35969?
To fix CVE-2022-35969, upgrade TensorFlow to a patched version that addresses the validation of input_sizes.
Which versions of TensorFlow are affected by CVE-2022-35969?
CVE-2022-35969 affects TensorFlow versions between 2.7.0 and 2.7.2, 2.8.0 and 2.8.1, 2.9.0 and 2.9.1, and the 2.10 release candidates.
What is the impact of CVE-2022-35969?
The impact of CVE-2022-35969 is that it can lead to a denial of service, rendering the affected application unusable.
Is there an official patch for CVE-2022-35969?
Yes, an official patch for CVE-2022-35969 is available in the newer versions of TensorFlow on GitHub.