cbcvebase.
CVE-2022-29205
published 2022-05-20

CVE-2022-29205: TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, there is a potential for segfault / denial of…

PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.32%
23.8th percentile
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, there is a potential for segfault / denial of service in TensorFlow by calling `tf.compat.v1.*` ops which don't yet have support for quantized types, which was added after migration to TensorFlow 2.x. In these scenarios, since the kernel is missing, a `nullptr` value is passed to `ParseDimensionValue` for the `py_value` argument. Then, this is dereferenced, resulting in segfault. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Affected

13 ranges
VendorProductVersion rangeFixed in
debiantensorflow——
googletensorflow< 2.6.42.6.4
googletensorflow——
googletensorflow——
googletensorflow——
googletensorflow>= 2.7.0 < 2.7.22.7.2
inteloptimization_for_tensorflow>= 0 < 2.6.42.6.4
inteloptimization_for_tensorflow>= 2.7.0 < 2.7.22.7.2
inteloptimization_for_tensorflow>= 2.8.0 < 2.8.12.8.1
tensorflowtensorflow< 2.6.42.6.4
tensorflowtensorflow——
tensorflowtensorflow——
tensorflowtensorflow——

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
vendor_debian5.5LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.