CVE-2022-35985 : What You Need to Know

This article provides detailed information about CVE-2022-35985, a vulnerability in TensorFlow that could lead to a denial of service attack.

Understanding CVE-2022-35985

This section delves into the nature and implications of the vulnerability found in TensorFlow.

What is CVE-2022-35985?

TensorFlow, an open-source machine learning platform, is susceptible to a

CHECK

fail in

LRNGrad

when provided with an

output_image

input tensor that is not 4-D. This flaw can be exploited for a denial of service attack.

The Impact of CVE-2022-35985

The vulnerability's CVSS score of 5.9 (Medium Severity) highlights its high attack complexity and impact on network availability. While it does not compromise confidentiality or integrity, immediate action is necessary to prevent exploitation.

Technical Details of CVE-2022-35985

This section presents specific technical details regarding the vulnerability in TensorFlow.

Vulnerability Description

The vulnerability arises from a

CHECK

fail in

LRNGrad

due to an improperly formatted input tensor, enabling malicious entities to launch denial of service attacks.

Affected Systems and Versions

TensorFlow versions below 2.7.2 and those between 2.8.0 to 2.8.1, as well as 2.9.0 to 2.9.1, are impacted by this vulnerability and require immediate attention.

Exploitation Mechanism

By providing a non-conforming input tensor to the

LRNGrad

function, attackers can trigger the vulnerability to disrupt services.

Mitigation and Prevention

This section outlines essential steps to mitigate and prevent the exploitation of CVE-2022-35985.

Immediate Steps to Take

Users and administrators should update TensorFlow to version 2.10.0, which includes a patch for the vulnerability. For versions 2.7.2, 2.8.1, and 2.9.1, the patch will be backported to address the issue.

Long-Term Security Practices

Regularly updating TensorFlow to the latest version and following security best practices can help prevent similar vulnerabilities in the future.

Patching and Updates

Staying informed about security advisories and promptly applying patches released by TensorFlow are crucial for maintaining a secure environment.