CVE-2022-29191: Improper Input Validation
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.raw_ops.GetSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
References
- github.com/advisories/GHSA-fv25-wrff-wf86
- github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc
- github.com/tensorflow/tensorflow/commit/48305e8ffe5246d67570b64096a96f8e315a7281
- github.com/tensorflow/tensorflow/releases/tag/v2.6.4
- github.com/tensorflow/tensorflow/releases/tag/v2.7.2
- github.com/tensorflow/tensorflow/releases/tag/v2.8.1
- github.com/tensorflow/tensorflow/releases/tag/v2.9.0
- github.com/tensorflow/tensorflow/security/advisories/GHSA-fv25-wrff-wf86
- nvd.nist.gov/vuln/detail/CVE-2022-29191
Code Behaviors & Features
Detect and mitigate CVE-2022-29191 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →