CVE-2022-35998: `CHECK` fail in `EmptyTensorList` in TensorFlow
First published: Fri Sep 16 2022(Updated: )
TensorFlow is an open source platform for machine learning. If `EmptyTensorList` receives an input `element_shape` with more than one dimension, it gives a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit c8ba76d48567aed347508e0552a257641931024d. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| TensorFlow Keras | <2.7.2 | |
| TensorFlow Keras | >=2.8.0<2.8.1 | |
| TensorFlow Keras | >=2.9.0<2.9.1 | |
| TensorFlow Keras | =2.10-rc0 | |
| TensorFlow Keras | =2.10-rc1 | |
| TensorFlow Keras | =2.10-rc2 | |
| TensorFlow Keras | =2.10-rc3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-35998?
CVE-2022-35998 has been classified as a denial of service vulnerability.
How do I fix CVE-2022-35998?
To mitigate CVE-2022-35998, upgrade TensorFlow to a version greater than 2.10-rc3.
What versions of TensorFlow are affected by CVE-2022-35998?
CVE-2022-35998 affects TensorFlow versions up to 2.7.2 and between 2.8.0 to 2.9.1, including 2.10-rc0 to 2.10-rc3.
What is the cause of CVE-2022-35998?
CVE-2022-35998 is caused by the EmptyTensorList failing a check when it receives an input element_shape with more than one dimension.
Can CVE-2022-35998 result in system downtime?
Yes, CVE-2022-35998 can trigger a denial of service attack, potentially causing system downtime.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/severity
- agent/author
- agent/remedy
- agent/event
- agent/first-publish-date
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/google
- canonical/tensorflow keras
- version/tensorflow keras/2.8.0
- version/tensorflow keras/2.9.0
- version/tensorflow keras/2.10-rc0
- version/tensorflow keras/2.10-rc1
- version/tensorflow keras/2.10-rc2
- version/tensorflow keras/2.10-rc3