CVE-2022-35938 : Security Advisory and Response

A detailed overview of CVE-2022-35938 impacting TensorFlow Lite Micro's

Gather_nd

operation.

Understanding CVE-2022-35938

This section provides insights into the vulnerability, impact, and affected systems related to CVE-2022-35938.

What is CVE-2022-35938?

CVE-2022-35938 affects TensorFlow Lite Micro, specifically the

Gather_nd

operation. The vulnerability arises when inputs exceed output sizes, potentially leading to memory read errors or crashes.

The Impact of CVE-2022-35938

The impact of this CVE is rated as high (CVSS score of 7) with a network-based attack vector and high availability impact, emphasizing the severity of the issue.

Technical Details of CVE-2022-35938

Explore the technical specifics of CVE-2022-35938, including the vulnerability description, affected systems, and exploitation mechanism.

Vulnerability Description

The vulnerability occurs due to input sizes surpassing output sizes in the

Gather_nd

operation, resulting in out-of-bounds memory reads or crashes.

Affected Systems and Versions

TensorFlow versions less than 2.7.2
TensorFlow versions greater than or equal to 2.8.0 and less than 2.8.1
TensorFlow versions greater than or equal to 2.9.0 and less than 2.9.1

Exploitation Mechanism

The vulnerability can be exploited through network-based attacks without requiring user interaction, highlighting the critical nature of the issue.

Mitigation and Prevention

Discover essential steps to mitigate the risks associated with CVE-2022-35938 and prevent potential exploitation.

Immediate Steps to Take

Ensure timely patching and updating of affected TensorFlow versions to prevent exploitation. Stay informed about security advisories and apply fixes promptly.

Long-Term Security Practices

Implement robust security measures, including regular vulnerability assessments, secure coding practices, and threat monitoring, to enhance overall system security.

Patching and Updates

Update affected TensorFlow versions to 2.10.0, which includes the necessary fix for CVE-2022-35938. Consider backporting the fix to TensorFlow versions 2.9.1, 2.8.1, and 2.7.2 within the supported range.