CVE-2022-29207

Katalog CVE

CVSS 5.5 · Medium EPSS 0,33%

Kerentanan Improper Input Validation pada google tensorflow. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid. In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Rincian

Terbit di NVD

20 Mei 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-475: Undefined Behavior for Input to API

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 23,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tensorflow/tensorflow/commit/a5b89cd68c02329d793356bda85d079e9e69b4e7 patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/commit/dbdd98c37bc25249e8f288bd30d01e118a7b4498 patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5wpj-c6f7-24x8 exploit · patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4 release notes · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2 release notes · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1 release notes · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0 release notes · advisory pihak ketiga