CVE-2022-35935 : What You Need to Know

This article provides details about CVE-2022-35935, a vulnerability in TensorFlow that can lead to a denial of service due to a

CHECK

failure in

SobolSample

without proper validation.

Understanding CVE-2022-35935

This section delves into the impact and technical details of the vulnerability.

What is CVE-2022-35935?

TensorFlow, an open-source machine learning platform, is susceptible to a denial of service exploit triggered by a

CHECK

failure in

SobolSample

due to missing validation. The vulnerability allows an attacker to cause a denial of service by assuming specific inputs to be scalar.

The Impact of CVE-2022-35935

The vulnerability has a CVSS base score of 5.9, with a medium severity level. It has a high impact on availability but does not affect confidentiality, integrity, or require privileges.

Technical Details of CVE-2022-35935

This section provides insights into the vulnerability description, affected systems, and exploitation mechanism.

Vulnerability Description

The vulnerability arises in the implementation of SobolSampleOp in TensorFlow, where inadequate validation of inputs leads to a CHECK failure, allowing an attacker to trigger a denial of service attack.

Affected Systems and Versions

The vulnerability affects TensorFlow versions < 2.7.2, >= 2.8.0, < 2.8.1, and >= 2.9.0, < 2.9.1. Users of these versions are urged to apply patches to mitigate the risk.

Exploitation Mechanism

Attackers can exploit this vulnerability remotely, with a high attack complexity via a network vector, resulting in a denial of service without the need for user interaction.

Mitigation and Prevention

To address CVE-2022-35935, users and organizations are advised to take immediate steps and adopt long-term security practices.

Immediate Steps to Take

Users should update TensorFlow to version 2.10.0 or apply the specific GitHub commit (c65c67f88ad770662e8f191269a907bf2b94b1bf) for versions 2.9.1, 2.8.1, and 2.7.2, as these are also affected.

Long-Term Security Practices

Implement secure coding practices, regularly update software, and stay informed about security advisories to enhance overall cybersecurity posture.

Patching and Updates

Regularly monitor for security patches and updates from TensorFlow to address vulnerabilities and enhance system security.