CVE-2022-35981: `CHECK` fail in `FractionalMaxPoolGrad` in TensorFlow
TensorFlow is an open source platform for machine learning. FractionalMaxPoolGrad validates its inputs with CHECK failures instead of with returning errors. If it gets incorrectly sized inputs, the CHECK failure can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 8741e57d163a079db05a7107a7609af70931def4. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-35981?
CVE-2022-35981 has been classified as a denial of service vulnerability due to improper input validation.
How do I fix CVE-2022-35981?
To fix CVE-2022-35981, update TensorFlow to the latest version that includes the security patch.
What versions are affected by CVE-2022-35981?
CVE-2022-35981 affects TensorFlow versions up to 2.7.2 and certain ranges within 2.8.0 to 2.9.1.
What types of attacks can be exploited through CVE-2022-35981?
CVE-2022-35981 can be exploited to trigger denial of service attacks through incorrectly sized inputs.
Who is the vendor responsible for CVE-2022-35981?
The vendor responsible for CVE-2022-35981 is Google, which maintains the TensorFlow project.