PT-2022-19466 · Google · Tensorflow

Mihaimaruseac · Published 2022-05-20 · Updated 2024-03-06 · CVE-2022-29213

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.9.0 TensorFlow versions prior to 2.8.1 TensorFlow versions prior to 2.7.2 TensorFlow versions prior to 2.6.4

Description The issue is related to the lack of input validation in the tf.compat.v1.signal.rfft2d and tf.compat.v1.signal.rfft3d functions, which can result in crashes due to CHECK-failures under certain conditions.

Recommendations For versions prior to 2.9.0, update to version 2.9.0 or later. For versions prior to 2.8.1, update to version 2.8.1 or later. For versions prior to 2.7.2, update to version 2.7.2 or later. For versions prior to 2.6.4, update to version 2.6.4 or later.

Exploit

Fix

Assertion Failure

RCE

Weakness Enumeration

CWE-617

CWE-20

Related Identifiers

BIT-TENSORFLOW-2022-29213

CVE-2022-29213

GHSA-5889-7V45-Q28M

Affected Products

Tensorflow

References · 16

• 🔥 https://github.com/tensorflow/tensorflow/issues/55263 · Exploit
• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5889-7v45-q28m · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29213.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/0a8a781e597b18ead006d19b7d23d0a369e9ad73 · Patch
• https://github.com/tensorflow/tensorflow/pull/55274 · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2022-29213 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5889-7v45-q28m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29213 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29213 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 · Note
• https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cvenotify/30537 · Telegram Post