CVE-2022-29209CWE-843

Type confusion leading to `CHECK`-failure based denial of service in TensorFlow

Medium · published May 20, 2022

CVSS v3.1
5.5
EPSS
0%
Percentile
32.5
In the wild
Unconfirmed
What it is

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.) have an incorrect logic when comparing `size_t` and `int` values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00395 · 32.5th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2022-05-20T23:25Z
EPSS history
Timeline
  • 20 MAY 23:25Z
    Type confusion leading to `CHECK`-failure based denial of service in TensorFlow
    cvelistv5