AVID-2026-R1015

Description

Missing validation crashes QuantizeAndDequantizeV4Grad in TensorFlow (CVE-2022-29192)

Details

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.raw_ops.QuantizeAndDequantizeV4Grad does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Reason for inclusion in AVID: CVE-2022-29192 is a TensorFlow vulnerability involving missing input validation in QuantizeAndDequantizeV4Grad, leading to a denial-of-service via a CHECK failure. TensorFlow is a core AI/ML framework used in building and running AI systems, and this issue affects versions prior to the patched releases, with patches provided. This is a software-supply-chain-relevant vulnerability in a widely-used AI software stack, not hardware/firmware-only. The report includes concrete CVE details, affected versions, and references, providing sufficient evidence.

References

Affected or Relevant Artifacts

Developer: tensorflow
Deployer: tensorflow
Artifact Details:

Type	Name
System	tensorflow

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score	5.5
Base Severity	🟠 Medium
Attack Vector	LOCAL
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	🔴 High

CWE

ID	Description
CWE-20	CWE-20: Improper Input Validation

Other information

Report Type: Advisory
Credits:
Date Reported: 2022-05-20
Version: 0.3.3
AVID Entry