Lucene search

GitHub_MCVE-2022-29208

HistoryMay 20, 2022 - 11:15 p.m.

CVE-2022-29208

2022-05-2023:15:45

CWE-787

GitHub_M

web.nvd.nist.gov

tensorflow

machine learning

cve-2022-29208

denial of service

security vulnerability

patch

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

40.1%

JSON

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.raw_ops.EditDistance has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service. In multiple places throughout the code, one may compute an index for a write operation. However, the existing validation only checks against the upper bound of the array. Hence, it is possible to write before the array by massaging the input to generate negative values for loc. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Affected configurations

Nvd

Vulners

Node

googletensorflowRange<2.6.4

googletensorflowRange2.7.0–2.7.2

googletensorflowMatch2.7.0rc0

googletensorflowMatch2.7.0rc1

googletensorflowMatch2.8.0-

googletensorflowMatch2.8.0rc0

googletensorflowMatch2.8.0rc1

googletensorflowMatch2.9.0rc0

googletensorflowMatch2.9.0rc1

VendorProductVersionCPE
googletensorflow*cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
googletensorflow2.7.0cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*
googletensorflow2.7.0cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*
googletensorflow2.8.0cpe:2.3:a:google:tensorflow:2.8.0:-:*:*:*:*:*:*
googletensorflow2.8.0cpe:2.3:a:google:tensorflow:2.8.0:rc0:*:*:*:*:*:*
googletensorflow2.8.0cpe:2.3:a:google:tensorflow:2.8.0:rc1:*:*:*:*:*:*
googletensorflow2.9.0cpe:2.3:a:google:tensorflow:2.9.0:rc0:*:*:*:*:*:*
googletensorflow2.9.0cpe:2.3:a:google:tensorflow:2.9.0:rc1:*:*:*:*:*:*

Vendor	Product	Version	CPE
google	tensorflow	*	cpe:2.3:a:google:tensorflow::::::::
google	tensorflow	2.7.0	cpe:2.3:a:google:tensorflow:2.7.0:rc0::::::
google	tensorflow	2.7.0	cpe:2.3:a:google:tensorflow:2.7.0:rc1::::::
google	tensorflow	2.8.0	cpe:2.3:a:google:tensorflow:2.8.0:-::::::
google	tensorflow	2.8.0	cpe:2.3:a:google:tensorflow:2.8.0:rc0::::::
google	tensorflow	2.8.0	cpe:2.3:a:google:tensorflow:2.8.0:rc1::::::
google	tensorflow	2.9.0	cpe:2.3:a:google:tensorflow:2.9.0:rc0::::::
google	tensorflow	2.9.0	cpe:2.3:a:google:tensorflow:2.9.0:rc1::::::

CNA Affected

[
  {
    "product": "tensorflow",
    "vendor": "tensorflow",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.6.4"
      },
      {
        "status": "affected",
        "version": ">= 2.7.0rc0, < 2.7.2"
      },
      {
        "status": "affected",
        "version": ">= 2.8.0rc0, < 2.8.1"
      },
      {
        "status": "affected",
        "version": ">= 2.9.0rc0, < 2.9.0"
      }
    ]
  }
]

References

github.com/tensorflow/tensorflow/commit/30721cf564cb029d34535446d6a5a6357bebc8e7

github.com/tensorflow/tensorflow/releases/tag/v2.6.4

github.com/tensorflow/tensorflow/releases/tag/v2.7.2

github.com/tensorflow/tensorflow/releases/tag/v2.8.1

github.com/tensorflow/tensorflow/releases/tag/v2.9.0

github.com/tensorflow/tensorflow/security/advisories/GHSA-2r2f-g8mw-9gvr

Social References

CVSS2

3.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:N/I:P/A:P

CVSS3

7.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

40.1%

JSON

Related for CVE-2022-29208