We use cookies to improve your experience on our site.
AVID-2026-R1032
Description
Type confusion leading to CHECK-failure based denial of service in TensorFlow (CVE-2022-29209)
Details
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., CHECK_LT, CHECK_GT, etc.) have an incorrect logic when comparing size_t and int values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Reason for inclusion in AVID: CVE-2022-29209 describes a type confusion in TensorFlow macros that can trigger a denial of service. TensorFlow is a core AI framework used in ML pipelines, training, serving, and deployment, making this a software supply-chain vulnerability within AI stacks. The issue is a security vulnerability (DoS) within software used to build AI systems, and the report provides sufficient evidence (CVE entry, advisories, and release notes).
References
- NVD entry
- https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
- https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2
- https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1
- https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4rr-5m7v-wxcw
- https://github.com/tensorflow/tensorflow/issues/55530
- https://github.com/tensorflow/tensorflow/pull/55730
- https://github.com/tensorflow/tensorflow/commit/b917181c29b50cb83399ba41f4d938dc369109a1
- https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/platform/default/logging.h
Affected or Relevant Artifacts
- Developer: tensorflow
- Deployer: tensorflow
- Artifact Details:
| Type | Name |
|---|---|
| System | tensorflow |
Impact
AVID Taxonomy Categorization
- Risk domains: Security
- SEP subcategories: S0100: Software Vulnerability
- Lifecycle stages: L06: Deployment
CVSS
| Version | 3.1 |
| Vector String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Base Score | 5.5 |
| Base Severity | 🟠 Medium |
| Attack Vector | LOCAL |
| Attack Complexity | 🟢 Low |
| Privileges Required | 🟢 Low |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | 🔴 High |
CWE
| ID | Description |
|---|---|
| CWE-843 | CWE-843: Access of Resource Using Incompatible Type (‘Type Confusion’) |
Other information
- Report Type: Advisory
- Credits:
- Date Reported: 2022-05-20
- Version: 0.3.3
- AVID Entry