Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2022-29202

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does not fully validate the input arguments. This results in a denial of service by consuming all available memory. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Published

2022-05-20T23:15:44.470

Last Modified

2024-11-21T06:58:42.247

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.5 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Access Vector: LOCAL
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL

Exploitability Score

3.9

Impact Score

2.9

Weaknesses

Type: Secondary
CWE-20
CWE-400
Type: Primary
CWE-1284

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	google	tensorflow	< 2.6.4	Yes
Application	google	tensorflow	< 2.7.2	Yes
Application	google	tensorflow	2.7.0	Yes
Application	google	tensorflow	2.7.0	Yes
Application	google	tensorflow	2.8.0	Yes
Application	google	tensorflow	2.8.0	Yes
Application	google	tensorflow	2.8.0	Yes
Application	google	tensorflow	2.9.0	Yes
Application	google	tensorflow	2.9.0	Yes

References

https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/python/ops/ragged/ragged_factory_ops.py#L146-L239 Third Party Advisory ([email protected])
https://github.com/tensorflow/tensorflow/commit/bd4d5583ff9c8df26d47a23e508208844297310e Patch, Third Party Advisory ([email protected])
https://github.com/tensorflow/tensorflow/issues/55199 Issue Tracking, Patch, Third Party Advisory ([email protected])
https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 Release Notes, Third Party Advisory ([email protected])
https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 Release Notes, Third Party Advisory ([email protected])
https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 Release Notes, Third Party Advisory ([email protected])
https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 Release Notes, Third Party Advisory ([email protected])
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cwpm-f78v-7m5c Exploit, Patch, Third Party Advisory ([email protected])
https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/python/ops/ragged/ragged_factory_ops.py#L146-L239 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/tensorflow/tensorflow/commit/bd4d5583ff9c8df26d47a23e508208844297310e Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/tensorflow/tensorflow/issues/55199 Issue Tracking, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cwpm-f78v-7m5c Exploit, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)