CVE-2022-29207CWE-20CWE-475

Undefined behavior when users supply invalid resource handles in TensorFlow

Medium · published May 20, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
24.3
In the wild
Unconfirmed
What it is

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00325 · 24.3th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-475 · Undefined Behavior for Input to API
Published
2022-05-20T22:10Z
EPSS history
Timeline
  • 20 MAY 22:10Z
    Undefined behavior when users supply invalid resource handles in TensorFlow
    cvelistv5