CVE-2022-35987: `CHECK` fail in `DenseBincount` in TensorFlow
First published: Fri Sep 16 2022(Updated: )
TensorFlow is an open source platform for machine learning. `DenseBincount` assumes its input tensor `weights` to either have the same shape as its input tensor `input` or to be length-0. A different `weights` shape will trigger a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit bf4c14353c2328636a18bfad1e151052c81d5f43. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TensorFlow Keras | <2.7.2 | |
| TensorFlow Keras | >=2.8.0<2.8.1 | |
| TensorFlow Keras | >=2.9.0<2.9.1 | |
| TensorFlow Keras | =2.10-rc0 | |
| TensorFlow Keras | =2.10-rc1 | |
| TensorFlow Keras | =2.10-rc2 | |
| TensorFlow Keras | =2.10-rc3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-35987?
CVE-2022-35987 has been classified with a severity level that can lead to denial of service due to a CHECK fail.
How do I fix CVE-2022-35987?
To fix CVE-2022-35987, update TensorFlow to a version that is not affected, specifically versions later than 2.10-rc3.
Which versions of TensorFlow are affected by CVE-2022-35987?
Versions of TensorFlow from 2.0 to 2.10-rc3 are affected by CVE-2022-35987.
What types of attacks can CVE-2022-35987 facilitate?
CVE-2022-35987 can facilitate denial of service attacks by causing a CHECK failure if the `weights` tensor shape is incorrect.
Is CVE-2022-35987 specific to certain configurations of TensorFlow?
CVE-2022-35987 occurs when the `weights` tensor does not match the expected shape in specific configurations of TensorFlow.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/severity
- agent/author
- agent/remedy
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/google
- canonical/tensorflow keras
- version/tensorflow keras/2.8.0
- version/tensorflow keras/2.9.0
- version/tensorflow keras/2.10-rc0
- version/tensorflow keras/2.10-rc1
- version/tensorflow keras/2.10-rc2
- version/tensorflow keras/2.10-rc3