CVE-2022-29203: Integer Overflow or Wraparound
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.raw_ops.SpaceToBatchND (in all backends such as XLA and handwritten kernels) is vulnerable to an integer overflow: The result of this integer overflow is used to allocate the output tensor, hence we get a denial of service via a CHECK-failure (assertion failure), as in TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
References
- github.com/advisories/GHSA-jjm6-4vf7-cjh4
- github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md
- github.com/tensorflow/tensorflow/commit/acd56b8bcb72b163c834ae4f18469047b001fadf
- github.com/tensorflow/tensorflow/releases/tag/v2.6.4
- github.com/tensorflow/tensorflow/releases/tag/v2.7.2
- github.com/tensorflow/tensorflow/releases/tag/v2.8.1
- github.com/tensorflow/tensorflow/releases/tag/v2.9.0
- github.com/tensorflow/tensorflow/security/advisories/GHSA-jjm6-4vf7-cjh4
- nvd.nist.gov/vuln/detail/CVE-2022-29203
Code Behaviors & Features
Detect and mitigate CVE-2022-29203 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →