CVE-2022-29207
Undefined behavior when users supply invalid resource handles in TensorFlow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
TensorFlow es una plataforma de código abierto para el aprendizaje automático. En versiones anteriores a 2.9.0, 2.8.1, 2.7.2 y 2.6.4, varias operaciones de TensorFlow se comportaban inapropiadamente en modo eager cuando el manejador de recursos que les era proporcionado no era válido. En el modo gráfico, habría sido imposible llevar a cabo estas llamadas a la API, pero la migración al modo eager de TF 2.x abrió esta vulnerabilidad. Si el manejador de recursos está vacío, entonces una referencia está ligada a un puntero null dentro de la base de código de TensorFlow (varios codepaths). Esto es un comportamiento no definido. Las versiones 2.9.0, 2.8.1, 2.7.2 y 2.6.4 contienen un parche para este problema
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-04-13 CVE Reserved
- 2022-05-20 CVE Published
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- 2024-08-11 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-475: Undefined Behavior for Input to API
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 | Release Notes | |
| https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 | Release Notes | |
| https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 | Release Notes | |
| https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 | Release Notes |
| URL | Date | SRC |
|---|---|---|
| https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5wpj-c6f7-24x8 | 2024-08-03 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | < 2.6.4 Search vendor "Google" for product "Tensorflow" and version " < 2.6.4" | - |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | >= 2.7.0 < 2.7.2 Search vendor "Google" for product "Tensorflow" and version " >= 2.7.0 < 2.7.2" | - |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.7.0 Search vendor "Google" for product "Tensorflow" and version "2.7.0" | rc0 |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.7.0 Search vendor "Google" for product "Tensorflow" and version "2.7.0" | rc1 |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.8.0 Search vendor "Google" for product "Tensorflow" and version "2.8.0" | - |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.8.0 Search vendor "Google" for product "Tensorflow" and version "2.8.0" | rc0 |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.8.0 Search vendor "Google" for product "Tensorflow" and version "2.8.0" | rc1 |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.9.0 Search vendor "Google" for product "Tensorflow" and version "2.9.0" | rc0 |
Affected
| ||||||
| Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | 2.9.0 Search vendor "Google" for product "Tensorflow" and version "2.9.0" | rc1 |
Affected
| ||||||