Vulnerability Details : CVE-2022-29212
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling `QuantizeMultiplierSmallerThanOneExp`, the `TFLITE_CHECK_LT` assertion would trigger and abort the process. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Vulnerability category: Input validation
Products affected by CVE-2022-29212
- cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.7.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.7.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.8.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.8.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.9.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.9.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.8.0:-:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-29212
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 41 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-29212
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:N/I:N/A:P |
3.9
|
2.9
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
NIST | |
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
1.8
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2022-29212
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: security-advisories@github.com (Primary)
References for CVE-2022-29212
-
https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
Release TensorFlow 2.6.4 · tensorflow/tensorflow · GitHubRelease Notes;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/issues/43661
Core dumped when invoking TFLite model converted using latest nightly TFLite converter (2.4.0dev2020929) · Issue #43661 · tensorflow/tensorflow · GitHubExploit;Issue Tracking;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2
Release TensorFlow 2.7.2 · tensorflow/tensorflow · GitHubRelease Notes;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0
Release TensorFlow 2.9.0 · tensorflow/tensorflow · GitHubRelease Notes;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1
Release TensorFlow 2.8.1 · tensorflow/tensorflow · GitHubRelease Notes;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/commit/a989426ee1346693cc015792f11d715f6944f2b8
Improve to cover scale value greater than one · tensorflow/tensorflow@a989426 · GitHubPatch;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8wwm-6264-x792
Core dump when loading TFLite models with quantization · Advisory · tensorflow/tensorflow · GitHubExploit;Patch;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/lite/kernels/internal/quantization_util.cc#L114-L123
tensorflow/quantization_util.cc at f3b9bf4c3c0597563b289c0512e98d4ce81f886e · tensorflow/tensorflow · GitHubThird Party Advisory
Jump to