5.5

CVE-2022-29207

Exploit

Undefined behavior when users supply invalid resource handles in TensorFlow

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Google ≫ Tensorflow Version < 2.6.4
Google ≫ Tensorflow Version >= 2.7.0 < 2.7.2
Google ≫ Tensorflow Version2.7.0 Updaterc0
Google ≫ Tensorflow Version2.7.0 Updaterc1
Google ≫ Tensorflow Version2.8.0 Update-
Google ≫ Tensorflow Version2.8.0 Updaterc0
Google ≫ Tensorflow Version2.8.0 Updaterc1
Google ≫ Tensorflow Version2.9.0 Updaterc0
Google ≫ Tensorflow Version2.9.0 Updaterc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.32% 0.232
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:N/I:N/A:P
security-advisories@github.com 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-475 Undefined Behavior for Input to API

The behavior of this function is undefined unless its control parameter is set to a specific value.

https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
Third Party Advisory
Release Notes
https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2
Third Party Advisory
Release Notes
https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1
Third Party Advisory
Release Notes
https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0
Third Party Advisory
Release Notes
https://github.com/tensorflow/tensorflow/commit/a5b89cd68c02329d793356bda85d079e9e69b4e7
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/dbdd98c37bc25249e8f288bd30d01e118a7b4498
Patch
Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5wpj-c6f7-24x8
Patch
Third Party Advisory
Exploit