CVE-2022-36026: `CHECK` fail in `QuantizeAndDequantizeV3` in TensorFlow
TensorFlow is an open source platform for machine learning. If QuantizeAndDequantizeV3 is given a nonscalar numbits input tensor, it results in a CHECK fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit f3f9cb38ecfe5a8a703f2c4a8fead434ef291713. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-36026?
CVE-2022-36026 has a severity classification that may lead to a denial of service attack.
How do I fix CVE-2022-36026?
To fix CVE-2022-36026, update TensorFlow to a patched version beyond 2.10-rc3.
Which versions are affected by CVE-2022-36026?
CVE-2022-36026 affects TensorFlow versions before 2.10-rc0, including specific versions between 2.7.0 and 2.9.1.
What type of attack can CVE-2022-36026 facilitate?
CVE-2022-36026 can facilitate a denial of service attack due to a CHECK failure when given a nonscalar num_bits input tensor.
What component is vulnerable in CVE-2022-36026?
The vulnerable component in CVE-2022-36026 is the QuantizeAndDequantizeV3 function in TensorFlow.