CVE-2022-35998 : Security Advisory and Response

A

CHECK

fail vulnerability in

EmptyTensorList

in TensorFlow could allow attackers to trigger a denial of service attack. Here's what you need to know about CVE-2022-35998.

Understanding CVE-2022-35998

This section provides detailed insights into the impact, technical details, and mitigation strategies related to CVE-2022-35998.

What is CVE-2022-35998?

CVE-2022-35998 is a vulnerability in TensorFlow, an open-source platform for machine learning. When

EmptyTensorList

receives an input

element_shape

with multiple dimensions, it results in a

CHECK

fail, which can be exploited to launch a denial of service attack.

The Impact of CVE-2022-35998

The vulnerability has a CVSS base score of 5.9, indicating a medium severity issue. The attack complexity is high with a network-based attack vector. Successful exploitation can result in a high availability impact.

Technical Details of CVE-2022-35998

Let's delve into the technical aspects of CVE-2022-35998.

Vulnerability Description

The vulnerability arises in the handling of input

element_shape

with more than one dimension by the

EmptyTensorList

function, leading to a

CHECK

fail.

Affected Systems and Versions

TensorFlow versions less than 2.7.2, between 2.8.0 and 2.8.1, and between 2.9.0 and 2.9.1 are affected by this vulnerability.

Exploitation Mechanism

Attackers can manipulate the

element_shape

input to trigger the

CHECK

fail, resulting in a denial of service condition.

Mitigation and Prevention

Protect your systems from CVE-2022-35998 with the following measures.

Immediate Steps to Take

Update TensorFlow to version 2.10.0 or apply the patch available in GitHub commit c8ba76d48567aed347508e0552a257641931024d.

Long-Term Security Practices

Regularly monitor security advisories and apply relevant patches promptly. Consider implementing input validation mechanisms to prevent similar vulnerabilities.

Patching and Updates

Ensure timely updates of TensorFlow to versions 2.10.0 or higher to mitigate the vulnerability effectively.