CVE-2022-35971: `CHECK` fail in `FakeQuantWithMinMaxVars` in TensorFlow
TensorFlow is an open source platform for machine learning. If FakeQuantWithMinMaxVars is given min or max tensors of a nonzero rank, it results in a CHECK fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-35971?
CVE-2022-35971 has a severity rating that indicates it can lead to a denial of service attack in TensorFlow.
How do I fix CVE-2022-35971?
To fix CVE-2022-35971, update TensorFlow to the patched version listed in the fix, ensuring you avoid vulnerable versions between 2.7.0 and 2.10-rc3.
Which versions of TensorFlow are affected by CVE-2022-35971?
The affected TensorFlow versions are between 2.7.0 to 2.7.2, 2.8.0 to 2.8.1, 2.9.0 to 2.9.1, and pre-release versions 2.10-rc0 to 2.10-rc3.
What impact does CVE-2022-35971 have on applications using TensorFlow?
CVE-2022-35971 can cause applications using TensorFlow to crash, leading to potential denial of service.
Is CVE-2022-35971 specific to certain TensorFlow functions?
Yes, CVE-2022-35971 specifically affects the `FakeQuantWithMinMaxVars` function when supplied with nonzero rank tensors.