CVE-2022-29203 : Security Advisory and Response

TensorFlow is an open-source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of

tf.raw_ops.SpaceToBatchND

is vulnerable to an integer overflow. This vulnerability can lead to a denial-of-service via a

CHECK

-failure. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 have patches available to address this issue.

Understanding CVE-2022-29203

This CVE impacts TensorFlow versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4 due to an integer overflow vulnerability in the implementation of

SpaceToBatchND

.

What is CVE-2022-29203?

The vulnerability in

SpaceToBatchND

allows attackers to trigger a denial-of-service condition by exploiting an integer overflow in certain versions of TensorFlow.

The Impact of CVE-2022-29203

With a CVSS 3.1 base score of 5.5 (Medium severity), this vulnerability has a low attack complexity and requires local access. It can result in high availability impact and does not affect confidentiality or integrity.

Technical Details of CVE-2022-29203

Vulnerability Description

The vulnerability is an integer overflow in the implementation of

SpaceToBatchND

, potentially leading to a denial-of-service through a

CHECK

-failure.

Affected Systems and Versions

TensorFlow versions < 2.6.4
TensorFlow versions >= 2.7.0rc0, < 2.7.2
TensorFlow versions >= 2.8.0rc0, < 2.8.1
TensorFlow versions >= 2.9.0rc0, < 2.9.0

Exploitation Mechanism

Attackers can exploit the integer overflow in

SpaceToBatchND

to trigger a denial-of-service condition in affected versions.

Mitigation and Prevention

It is crucial to take immediate steps to address and prevent exploitation of CVE-2022-29203.

Immediate Steps to Take

Users should update their TensorFlow installations to versions 2.9.0, 2.8.1, 2.7.2, or 2.6.4 that contain patches for the integer overflow vulnerability.

Long-Term Security Practices

Regularly update TensorFlow to the latest version to ensure that known vulnerabilities are patched promptly.

Patching and Updates

Stay informed about security advisories and update TensorFlow promptly whenever new patches are released.