GitHub_MCVELIST:CVE-2022-29213CVE-2022-29213 Incomplete validation in signal ops leads to crashes in TensorFlow
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
31.3%
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d lack input validation and under certain condition can result in crashes (due to CHECK-failures). Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
CNA Affected
[
{
"product": "tensorflow",
"vendor": "tensorflow",
"versions": [
{
"status": "affected",
"version": "< 2.6.4"
},
{
"status": "affected",
"version": ">= 2.7.0rc0, < 2.7.2"
},
{
"status": "affected",
"version": ">= 2.8.0rc0, < 2.8.1"
},
{
"status": "affected",
"version": ">= 2.9.0rc0, < 2.9.0"
}
]
}
]References
github.com/tensorflow/tensorflow/commit/0a8a781e597b18ead006d19b7d23d0a369e9ad73
github.com/tensorflow/tensorflow/issues/55263
github.com/tensorflow/tensorflow/pull/55274
github.com/tensorflow/tensorflow/releases/tag/v2.6.4
github.com/tensorflow/tensorflow/releases/tag/v2.7.2
github.com/tensorflow/tensorflow/releases/tag/v2.8.1
github.com/tensorflow/tensorflow/releases/tag/v2.9.0
github.com/tensorflow/tensorflow/security/advisories/GHSA-5889-7v45-q28m
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
31.3%