CVE-2022-29202

Summary

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.ragged.constant does not fully validate the input arguments. This results in a denial of service by consuming all available memory. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Affected Software

VendorProductVersion RangeStatus
tensorflowtensorflow< 2.6.4affected
tensorflowtensorflow>= 2.7.0rc0, < 2.7.2affected
tensorflowtensorflow>= 2.8.0rc0, < 2.8.1affected
tensorflowtensorflow>= 2.9.0rc0, < 2.9.0affected

Weaknesses

  • CWE-20: CWE-20: Improper Input Validation
  • CWE-400: CWE-400: Uncontrolled Resource Consumption

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: partial

References