CVE-2022-36002: `CHECK` fail in `Unbatch` in TensorFlow
TensorFlow is an open source platform for machine learning. When Unbatch receives a nonscalar input id, it gives a CHECK fail that can trigger a denial of service attack. We have patched the issue in GitHub commit 4419d10d576adefa36b0e0a9425d2569f7c0189f. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36002?
CVE-2022-36002 has been reported as a denial of service vulnerability.
How do I fix CVE-2022-36002?
To fix CVE-2022-36002, update TensorFlow to a version beyond 2.10-rc3 as per the patch in GitHub commit 4419d10d.
What components are affected by CVE-2022-36002?
CVE-2022-36002 affects multiple versions of TensorFlow including versions from 2.7.2 to 2.10-rc3.
What happens if CVE-2022-36002 is exploited?
Exploitation of CVE-2022-36002 can lead to a denial of service condition in TensorFlow.
Which TensorFlow versions should be upgraded to address CVE-2022-36002?
Users should upgrade to TensorFlow versions greater than 2.10-rc3 to mitigate CVE-2022-36002.