CVE-2022-29204: Missing validation causes denial of service via `Conv3DBackpropFilterV2`
(updated )
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.raw_ops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. The code assumes num_segments is a positive scalar but there is no validation. Since this value is used to allocate the output tensor, a negative value would result in a CHECK-failure (assertion failure), as per TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
References
- github.com/advisories/GHSA-hx9q-2mx4-m4pg
- github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/unsorted_segment_join_op.cc
- github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md
- github.com/tensorflow/tensorflow/commit/20cb18724b0bf6c09071a3f53434c4eec53cc147
- github.com/tensorflow/tensorflow/commit/84563f265f28b3c36a15335c8b005d405260e943
- github.com/tensorflow/tensorflow/releases/tag/v2.6.4
- github.com/tensorflow/tensorflow/releases/tag/v2.7.2
- github.com/tensorflow/tensorflow/releases/tag/v2.8.1
- github.com/tensorflow/tensorflow/releases/tag/v2.9.0
- github.com/tensorflow/tensorflow/security/advisories/GHSA-hx9q-2mx4-m4pg
- nvd.nist.gov/vuln/detail/CVE-2022-29204
Code Behaviors & Features
Detect and mitigate CVE-2022-29204 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →