Log in Start free

Vulnerability · Published May 20, 2022 · Assigned by GitHub_M

CVE-2022-29209Type confusion leading to `CHECK`-failure based denial of service in TensorFlow

Medium 5.5

In plain English

A medium-severity type confusion in tensorflow from tensorflow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 66.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.) have an incorrect logic when comparing `size_t` and `int` values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPItensorflow2.6.4, 2.7.2, 2.8.1PYSEC-2026-3167
PyPItensorflow2.6.4GHSA-f4rr-5m7v-wxcw
PyPItensorflow2.7.2GHSA-f4rr-5m7v-wxcw
PyPItensorflow2.8.1GHSA-f4rr-5m7v-wxcw
PyPItensorflow-cpu2.7.2GHSA-f4rr-5m7v-wxcw
PyPItensorflow-cpu2.6.4, 2.7.2, 2.8.1PYSEC-2026-3315
PyPItensorflow-cpu2.6.4GHSA-f4rr-5m7v-wxcw
PyPItensorflow-cpu2.8.1GHSA-f4rr-5m7v-wxcw
PyPItensorflow-gpu2.6.4, 2.7.2, 2.8.1PYSEC-2026-986
PyPItensorflow-gpu2.6.4GHSA-f4rr-5m7v-wxcw
PyPItensorflow-gpu2.7.2GHSA-f4rr-5m7v-wxcw
PyPItensorflow-gpu2.8.1GHSA-f4rr-5m7v-wxcw

Affected products (as reported)

VendorProductVersions
tensorflow tensorflow < 2.6.4>= 2.7.0rc0, < 2.7.2>= 2.8.0rc0, < 2.8.1>= 2.9.0rc0, < 2.9.0

Weakness: CWE-843 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References