CVE-2022-29204 | Vulnetix

CVE-2022-29204 PUBLISHED CVSS 5.5 MEDIUM

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a positive scalar but there is no validation. Since this value is used to allocate the output tensor, a negative value would result in a `CHECK`-failure (assertion failure), as per TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

EPSS 0.35% · 28.5th percentile

Risk Scores

CVSS 3.1

5.5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.35%

28.5th percentile

Affected Products

Vendor	Product	Versions
Bitnami	tensorflow	2.7.0, 1.15.0, 2.8.0
Bitnami	tensorflow	1.15.0, 2.7.0, 2.8.0

Timeline

May 20, 2022 CVE Published
May 21, 2022 EPSS Score
Jul 9, 2022 EPSS Score
Aug 29, 2022 EPSS Score
Oct 17, 2022 EPSS Score
Dec 5, 2022 EPSS Score
Jan 23, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 14, 2023 EPSS Score
May 2, 2023 EPSS Score
Jun 20, 2023 EPSS Score
Aug 8, 2023 EPSS Score

References

Open in Interactive Console →