NetSight
IP …
medium5.5

CVE-2022-29200

TensorFlow is an open source platform for machine learning.

Impact

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate the ranks of any of the arguments to this API call. This results in `CHECK`-failures when the elements of the tensor are accessed. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Affected products

VendorProductAffected versions
GoogleTensorflow
before 2.6.4
from 2.7.0 before 2.7.2
Versions 2.7.0, 2.8.0, 2.9.0

Weakness classification

CWE-20CWE-1284

References