CVE-2022-29207
Summary
| CVE | CVE-2022-29207 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2022-05-20 22:16:00 UTC |
| Updated | 2022-06-02 18:12:00 UTC |
| Description | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue. |
Risk And Classification
Problem Types: CWE-20 | CWE-475
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Tensorflow | All | All | All | All | |
| Application | Tensorflow | 2.7.0 | rc0 | All | All | |
| Application | Tensorflow | 2.7.0 | rc1 | All | All | |
| Application | Tensorflow | 2.8.0 | - | All | All | |
| Application | Tensorflow | 2.8.0 | rc0 | All | All | |
| Application | Tensorflow | 2.8.0 | rc1 | All | All | |
| Application | Tensorflow | 2.9.0 | rc0 | All | All | |
| Application | Tensorflow | 2.9.0 | rc1 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Release TensorFlow 2.8.1 · tensorflow/tensorflow · GitHub | MISC | github.com | |
| Undefined behavior when users supply invalid resource handles · Advisory · tensorflow/tensorflow · GitHub | CONFIRM | github.com | |
| Release TensorFlow 2.9.0 · tensorflow/tensorflow · GitHub | MISC | github.com | |
| Release TensorFlow 2.7.2 · tensorflow/tensorflow · GitHub | MISC | github.com | |
| Release TensorFlow 2.6.4 · tensorflow/tensorflow · GitHub | MISC | github.com | |
| Fix empty resource handle vulnerability. · tensorflow/tensorflow@a5b89cd · GitHub | MISC | github.com | |
| Fix segfault from passing invalid input to tf.summary.flush() · tensorflow/tensorflow@dbdd98c · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.