PT-2022-19446 · Google · Tensorflow

Neophytos Christou · Published 2022-05-20 · Updated 2024-03-06 · CVE-2022-29194

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.9.0 TensorFlow versions prior to 2.8.1 TensorFlow versions prior to 2.7.2 TensorFlow versions prior to 2.6.4

Description TensorFlow is an open source platform for machine learning. The implementation of tf.raw ops.DeleteSessionTensor does not fully validate the input arguments, resulting in a CHECK-failure which can be used to trigger a denial of service attack.

Recommendations For versions prior to 2.9.0, update to version 2.9.0 or later. For versions prior to 2.8.1, update to version 2.8.1 or later. For versions prior to 2.7.2, update to version 2.7.2 or later. For versions prior to 2.6.4, update to version 2.6.4 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-TENSORFLOW-2022-29194

CVE-2022-29194

GHSA-H5G4-PPWX-48Q2

Affected Products

Tensorflow

References · 15

• 🔥 https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L128-L144 · Exploit
• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h5g4-ppwx-48q2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29194.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/cff267650c6a1b266e4b4500f69fbc49cdd773c5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29194 · Security Note
• https://osv.dev/vulnerability/GHSA-h5g4-ppwx-48q2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-29194 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29194 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 · Note
• https://t.me/cvenotify/31000 · Telegram Post
• https://t.me/cibsecurity/43099 · Telegram Post