CVE-2022-29211 | Vulnetix

CVE-2022-29211 PUBLISHED CVSS 5.5 MEDIUM

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.histogram_fixed_width` is vulnerable to a crash when the values array contain `Not a Number` (`NaN`) elements. The implementation assumes that all floating point operations are defined and then converts a floating point result to an integer index. If `values` contains `NaN` then the result of the division is still `NaN` and the cast to `int32` would result in a crash. This only occurs on the CPU implementation. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

EPSS 0.32% · 24.8th percentile

Risk Scores

CVSS 3.1

5.5

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score

0.32%

24.8th percentile

Affected Products

Vendor	Product	Versions
Bitnami	tensorflow	0, 2.7.0, 2.8.0
Bitnami	tensorflow	0, 2.8.0, 2.7.0

Timeline

May 20, 2022 CVE Published
May 21, 2022 EPSS Score
Jul 9, 2022 EPSS Score
Aug 28, 2022 EPSS Score
Oct 17, 2022 EPSS Score
Dec 5, 2022 EPSS Score
Jan 23, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Mar 13, 2023 EPSS Score
May 2, 2023 EPSS Score
Jun 20, 2023 EPSS Score
Aug 8, 2023 EPSS Score

References

Open in Interactive Console →