CVE-2022-35965 : What You Need to Know

A detailed overview of CVE-2022-35965, a vulnerability in TensorFlow that can lead to a denial of service attack due to a segfault triggered by empty inputs.

Understanding CVE-2022-35965

In this section, we will delve into what CVE-2022-35965 entails and the impact it can have.

What is CVE-2022-35965?

The vulnerability in TensorFlow arises when

LowerBound

or

UpperBound

is provided with an empty input, resulting in a

nullptr

dereference and subsequent segfault. This flaw can be exploited to launch a denial of service attack.

The Impact of CVE-2022-35965

The impact of CVE-2022-35965 is rated as medium severity with a base score of 5.9 according to the CVSS v3.1 metrics. The attack complexity is high, and an attacker can exploit this vulnerability over a network without requiring any special privileges.

Technical Details of CVE-2022-35965

In this section, we will explore the technical aspects of CVE-2022-35965, including the vulnerability description, affected systems, and the exploitation mechanism.

Vulnerability Description

The vulnerability allows for a NULL Pointer Dereference (CWE-476) in TensorFlow, leading to a segfault and enabling a denial of service attack.

Affected Systems and Versions

The affected versions of TensorFlow include < 2.7.2, >= 2.8.0, < 2.8.1, and >= 2.9.0, < 2.9.1. It is crucial to update to TensorFlow 2.10.0 to mitigate this issue.

Exploitation Mechanism

Exploiting this vulnerability requires sending malicious input that triggers the

LowerBound

or

UpperBound

functions with empty parameters.

Mitigation and Prevention

In this final section, we will cover the necessary steps to mitigate and prevent exploitation of CVE-2022-35965.

Immediate Steps to Take

Users are advised to update their TensorFlow installations to version 2.10.0 to patch the vulnerability. It is also recommended to apply the fix to TensorFlow 2.9.1, 2.8.1, and 2.7.2 if still in use.

Long-Term Security Practices

To enhance security posture, developers and users should follow secure coding practices, conduct regular security assessments, and stay informed about software updates.

Patching and Updates

Regularly check for security advisories and updates from TensorFlow to address any emerging vulnerabilities and apply patches promptly.