CVE-2022-29209

Type confusion leading to `CHECK`-failure based denial of service in TensorFlow

CVSS 5.5 MEDIUMEPSS 0.4%CWE-843

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.5EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

20 May 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.) have an incorrect logic when comparing `size_t` and `int` values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

tensorflow · tensorflow

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References