CVE-2022-35986 Explained : Impact and Mitigation

TensorFlow is an open-source platform for machine learning that recently experienced a vulnerability in the

RaggedBincount

function. This vulnerability could lead to a denial of service attack due to a segfault issue. Find out more about CVE-2022-35986 below.

Understanding CVE-2022-35986

This section delves into the details of the vulnerability, its impact, technical description, affected systems, and mitigation strategies.

What is CVE-2022-35986?

CVE-2022-35986 involves a vulnerability in TensorFlow's

RaggedBincount

function, allowing attackers to trigger a denial of service attack through a segfault occurrence.

The Impact of CVE-2022-35986

The vulnerability has a CVSS base score of 5.9 (Medium severity) with high attack complexity and availability impact. It does not require any special privileges for exploitation and has a network attack vector.

Technical Details of CVE-2022-35986

In this section, we will explore the technical aspects of the vulnerability, including the description, affected systems and versions, and exploitation mechanism.

Vulnerability Description

The issue occurs when

RaggedBincount

receives an empty input tensor

splits

, leading to a segfault that can be maliciously utilized for a denial of service attack.

Affected Systems and Versions

The vulnerability affects TensorFlow versions prior to 2.7.2 and between 2.8.0 to 2.8.1, as well as 2.9.0 to 2.9.1.

Exploitation Mechanism

Attackers can exploit this vulnerability by providing specific input to the

RaggedBincount

function.

Mitigation and Prevention

This section covers the necessary steps to mitigate the risks posed by CVE-2022-35986.

Immediate Steps to Take

Users should update TensorFlow to version 2.10.0 where the issue has been patched. For versions 2.7.2, 2.8.1, and 2.9.1, the fix will be cherrypicked to address the vulnerability.

Long-Term Security Practices

It is recommended to keep TensorFlow and other software up-to-date to prevent such vulnerabilities in the future.

Patching and Updates

Regularly check for security advisories from TensorFlow and apply patches promptly to secure your systems.