CVE-2022-29209: Type confusion leading to `CHECK`-failure based denial of service in TensorFlow
5.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.24125%
CWE
Published
5/24/2022
Updated
1/30/2023
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.6.4 | 2.6.4 |
| tensorflow | pip | >= 2.7.0, < 2.7.2 | 2.7.2 |
| tensorflow | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-cpu | pip | < 2.6.4 | 2.6.4 |
| tensorflow-cpu | pip | >= 2.7.0, < 2.7.2 | 2.7.2 |
| tensorflow-cpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
| tensorflow-gpu | pip | < 2.6.4 | 2.6.4 |
| tensorflow-gpu | pip | >= 2.7.0, < 2.7.2 | 2.7.2 |
| tensorflow-gpu | pip | >= 2.8.0, < 2.8.1 | 2.8.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from type confusion in CHECK_OP macros when comparing size_t (unsigned) and int (signed) values. The original implementations in logging.h contained specific overloads for (size_t, int) and (int, size_t) comparisons that improperly handled negative values and integer ranges. The commit diff shows these functions were replaced with safer implementations that add explicit checks for negative values and proper type conversions. The vulnerable functions are the pre-patch implementations of various Check_*Impl macros that handled mixed size_t/int comparisons without proper validation.