CVE-2022-29209 Information

Jun 07, 2022 cve

Description

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0 2.8.1 2.7.2 and 2.6.4 the macros that TensorFlow uses for writing assertions (e.g. CHECK_LT CHECK_GT etc.) have an incorrect logic when comparing size_t and int values. Due to type conversion rules several of the macros would trigger incorrectly. Versions 2.9.0 2.8.1 2.7.2 and 2.6.4 contain a patch for this issue.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Reference

https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/platform/default/logging.h https://github.com/tensorflow/tensorflow/issues/55530 https://github.com/tensorflow/tensorflow/commit/b917181c29b50cb83399ba41f4d938dc369109a1 https://github.com/tensorflow/tensorflow/pull/55730 https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4rr-5m7v-wxcw https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

NONE

Base Score

HIGH

Base Severity

5.5

Share on: