CVE-2022-35979: Segfault in `QuantizedRelu` and `QuantizedRelu6`
TensorFlow is an open source platform for machine learning. If QuantizedRelu or QuantizedRelu6 are given nonscalar inputs for minfeatures or maxfeatures, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 49b3824d83af706df0ad07e4e677d88659756d89. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-35979?
CVE-2022-35979 has been classified as a denial of service vulnerability.
How do I fix CVE-2022-35979?
To mitigate CVE-2022-35979, update TensorFlow to version 2.10-rc4 or later.
What versions of TensorFlow are affected by CVE-2022-35979?
CVE-2022-35979 affects TensorFlow versions up to and including 2.10-rc3, and all versions from 2.7.2 to below 2.10-rc4.
What components of TensorFlow are involved in CVE-2022-35979?
The vulnerability in CVE-2022-35979 involves the `QuantizedRelu` or `QuantizedRelu6` operations.
Can CVE-2022-35979 be exploited remotely?
Yes, CVE-2022-35979 can be exploited to trigger a denial of service remotely.