CVE-2022-35996 Explained : Impact and Mitigation

TensorFlow, an open-source platform for machine learning, is affected by a vulnerability in the

Conv2D

function that can lead to a denial of service attack due to division-by-zero floating point exceptions.

Understanding CVE-2022-20657

This CVE-2022-35996 impacts TensorFlow users, potentially allowing malicious actors to trigger a denial of service attack through a specific function.

What is CVE-2022-20657?

The vulnerability arises when the

Conv2D

function is provided with an empty input, causing division-by-zero floating point exceptions. This can be exploited by attackers to launch denial of service attacks.

The Impact of CVE-2022-20657

The impact of this vulnerability is rated as MEDIUM with a CVSS base score of 5.9. It has a HIGH availability impact, with no impact on confidentiality or integrity. The attack complexity is considered HIGH, with the attack vector being through the network.

Technical Details of CVE-2022-20657

This section delves into the specific technical aspects of the vulnerability.

Vulnerability Description

The issue arises in TensorFlow versions prior to 2.7.2, between 2.8.0 and 2.8.1, and between 2.9.0 and 2.9.1, where an empty input to

Conv2D

can result in all-zero output and subsequent floating point exceptions.

Affected Systems and Versions

The vulnerability affects TensorFlow versions prior to 2.7.2, 2.8.0 to 2.8.1, and 2.9.0 to 2.9.1. Users of these versions are advised to take immediate action.

Exploitation Mechanism

By exploiting the division-by-zero floating point exceptions triggered by providing empty inputs to the

Conv2D

function, attackers can execute denial of service attacks.

Mitigation and Prevention

Protecting systems from CVE-2022-35996 requires immediate actions and long-term security practices.

Immediate Steps to Take

Users should upgrade to TensorFlow 2.10.0 or apply the patch provided in commit 611d80db29dd7b0cfb755772c69d60ae5bca05f9. For versions 2.9.1, 2.8.1, and 2.7.2, the commit will be cherrypicked to address the issue.

Long-Term Security Practices

To prevent similar vulnerabilities, users are encouraged to regularly update their TensorFlow installations and follow best security practices.

Patching and Updates

Stay informed about security advisories and promptly apply patches released by TensorFlow to address known vulnerabilities.