CVE-2022-35983: `CHECK` fail in `Save` and `SaveSlices` in TensorFlow
TensorFlow is an open source platform for machine learning. If Save or SaveSlices is run over tensors of an unsupported dtype, it results in a CHECK fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 5dd7b86b84a864b834c6fa3d7f9f51c87efa99d4. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-35983?
CVE-2022-35983 has a medium severity rating due to the potential for denial of service attacks.
How do I fix CVE-2022-35983?
To fix CVE-2022-35983, update TensorFlow to the latest version that includes the patch for the vulnerability.
Which TensorFlow versions are affected by CVE-2022-35983?
CVE-2022-35983 affects TensorFlow versions up to 2.7.2 and certain versions between 2.8.0 and 2.9.1.
What can happen if I don't address CVE-2022-35983?
If CVE-2022-35983 is not addressed, it may lead to application crashes and possible denial of service.
Is there a security advisory related to CVE-2022-35983?
Yes, there is a security advisory available for CVE-2022-35983 that details the issue and recommended actions.