CVE-2022-29204: google tensorflow

csirt@kutim:~/threat-intel/cve/CVE-2022-29204

CVSS 5.5 · Medium EPSS 0,35%

Kerentanan Improper Input Validation pada google tensorflow. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegmentJoin` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code assumes `num_segments` is a positive scalar but there is no validation. Since this value is used to allocate the output tensor, a negative value would result in a `CHECK`-failure (assertion failure), as per TFSA-2021-198. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Rincian

Terbit di NVD: 20 Mei 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-20: Improper Input Validation
CWE-191: Integer Underflow (Wrap or Wraparound)
EPSS (30 hari): 0,35% peluang dieksploitasi; lebih tinggi dari 27,2% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
google	tensorflow	Versi 1.15.0 hingga sebelum 2.6.4
google	tensorflow	Versi 2.7.0 hingga sebelum 2.7.2
google	tensorflow	Versi 2.7.0 rc0
google	tensorflow	Versi 2.7.0 rc1
google	tensorflow	Versi 2.8.0
google	tensorflow	Versi 2.8.0 rc0
google	tensorflow	Versi 2.8.0 rc1
google	tensorflow	Versi 2.9.0 rc0
google	tensorflow	Versi 2.9.0 rc1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md patch · advisory pihak ketiga
https://github.com/tensorflow/tensorflow/commit/20cb18724b0bf6c09071a3f53434c4eec53cc147 patch · advisory pihak ketiga
https://github.com/tensorflow/tensorflow/commit/84563f265f28b3c36a15335c8b005d405260e943 patch · advisory pihak ketiga
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hx9q-2mx4-m4pg exploit · patch · advisory pihak ketiga
https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels... advisory pihak ketiga
https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 release notes · advisory pihak ketiga
https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 release notes · advisory pihak ketiga
https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 release notes · advisory pihak ketiga
https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 release notes · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.