What is the severity of CVE-2022-35986?

CVE-2022-35986 is classified as a denial of service vulnerability due to a segmentation fault.

How do I fix CVE-2022-35986?

To fix CVE-2022-35986, upgrade to TensorFlow version 2.7.2 or later.

Which versions of TensorFlow are affected by CVE-2022-35986?

CVE-2022-35986 affects TensorFlow versions prior to 2.7.2 and between 2.8.0 and 2.9.1.

Can CVE-2022-35986 be exploited remotely?

Yes, CVE-2022-35986 can be exploited remotely to trigger a denial of service.

What components of TensorFlow does CVE-2022-35986 impact?

CVE-2022-35986 impacts the RaggedBincount operation within TensorFlow.

Vulnerability/
CVE-2022-35986

high

7.5

CWE

16/9/2022

3/8/2024

CVE-2022-35986: Segfault in `RaggedBincount` in TensorFlow

First published: Fri Sep 16 2022(Updated: )

TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 7a4591fd4f065f4fa903593bc39b2f79530a74b8. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
TensorFlow Keras	<2.7.2
TensorFlow Keras	>=2.8.0<2.8.1
TensorFlow Keras	>=2.9.0<2.9.1
TensorFlow Keras	=2.10-rc0
TensorFlow Keras	=2.10-rc1
TensorFlow Keras	=2.10-rc2
TensorFlow Keras	=2.10-rc3

Remedy

https://github.com/tensorflow/tensorflow/commit/7a4591fd4f065f4fa903593bc39b2f79530a74b8

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2022-35986?
CVE-2022-35986 is classified as a denial of service vulnerability due to a segmentation fault.
How do I fix CVE-2022-35986?
To fix CVE-2022-35986, upgrade to TensorFlow version 2.7.2 or later.
Which versions of TensorFlow are affected by CVE-2022-35986?
CVE-2022-35986 affects TensorFlow versions prior to 2.7.2 and between 2.8.0 and 2.9.1.
Can CVE-2022-35986 be exploited remotely?
Yes, CVE-2022-35986 can be exploited remotely to trigger a denial of service.
What components of TensorFlow does CVE-2022-35986 impact?
CVE-2022-35986 impacts the RaggedBincount operation within TensorFlow.

agent/references
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/weakness
agent/title
agent/last-modified-date
agent/severity
agent/author
agent/remedy
agent/event
agent/first-publish-date
agent/description
agent/source
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/google
canonical/tensorflow keras
version/tensorflow keras/2.8.0
version/tensorflow keras/2.9.0
version/tensorflow keras/2.10-rc0
version/tensorflow keras/2.10-rc1
version/tensorflow keras/2.10-rc2
version/tensorflow keras/2.10-rc3

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.