PT-2022-19461 · Google · Tensorflow

Mihaimaruseac · Published 2022-05-20 · Updated 2024-03-06 · CVE-2022-29209

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.9.0 TensorFlow versions prior to 2.8.1 TensorFlow versions prior to 2.7.2 TensorFlow versions prior to 2.6.4

Description TensorFlow is an open source platform for machine learning. The macros that TensorFlow uses for writing assertions (e.g., CHECK LT, CHECK GT, etc.) have an incorrect logic when comparing size t and int values. Due to type conversion rules, several of the macros would trigger incorrectly.

Recommendations For versions prior to 2.9.0, update to version 2.9.0 or later. For versions prior to 2.8.1, update to version 2.8.1 or later. For versions prior to 2.7.2, update to version 2.7.2 or later. For versions prior to 2.6.4, update to version 2.6.4 or later.

Exploit

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

BIT-TENSORFLOW-2022-29209

CVE-2022-29209

GHSA-F4RR-5M7V-WXCW

Affected Products

Tensorflow

References · 17

• 🔥 https://github.com/tensorflow/tensorflow/issues/55530 · Exploit
• 🔥 https://github.com/tensorflow/tensorflow/pull/55730 · Exploit
• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4rr-5m7v-wxcw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29209.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/b917181c29b50cb83399ba41f4d938dc369109a1 · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2022-29209 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f4rr-5m7v-wxcw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29209 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29209 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 · Note
• https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/platform/default/logging.h · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 · Note
• https://github.com/tensorflow/tensorflow · Note