PT-2022-19465 · Google · Tensorflow

Mihaimaruseac · Published 2022-05-20 · Updated 2024-03-06 · CVE-2022-29212

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.9.0 TensorFlow versions prior to 2.8.1 TensorFlow versions prior to 2.7.2 TensorFlow versions prior to 2.6.4

Description TensorFlow is an open source platform for machine learning. Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The issue arises because during quantization, the scale of values could be greater than 1, but the code always assumes sub-unit scaling. As a result, the code calls QuantizeMultiplierSmallerThanOneExp, triggering the TFLITE CHECK LT assertion and aborting the process.

Recommendations For versions prior to 2.9.0, update to version 2.9.0 or later. For versions prior to 2.8.1, update to version 2.8.1 or later. For versions prior to 2.7.2, update to version 2.7.2 or later. For versions prior to 2.6.4, update to version 2.6.4 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-TENSORFLOW-2022-29212

CVE-2022-29212

GHSA-8WWM-6264-X792

Affected Products

Tensorflow

References · 15

• 🔥 https://github.com/tensorflow/tensorflow/issues/43661 · Exploit
• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8wwm-6264-x792 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29212.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/a989426ee1346693cc015792f11d715f6944f2b8 · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2022-29212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29212 · Security Note
• https://osv.dev/vulnerability/GHSA-8wwm-6264-x792 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-29212 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/lite/kernels/internal/quantization_util.cc#L114-L123 · Note
• https://t.me/cibsecurity/43132 · Telegram Post