Input validation error in TensorFlow - CVE-2022-29213
Published: July 26, 2022
Vulnerability identifier: #VU65775
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-29213
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in "tf.compat.v1.signal.rfft2d" and "tf.compat.v1.signal.rfft3d". A local user can pass specially crafted input to the application and perform a denial of service (DoS) attack.
Affected software
TensorFlow
My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud
My Cloud OS 5
My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud
My Cloud OS 5
How to mitigate CVE-2022-29213
Install updates from vendor's website.
TensorFlow - addressed in versions 2.6.4, 2.7.2, 2.8.1, 2.9.0
My Cloud OS 5 - update to 5.23.114
My Cloud OS 5 - update to 5.23.114
External References
- https://github.com/tensorflow/tensorflow/issues/55263
- https://github.com/tensorflow/tensorflow/commit/0a8a781e597b18ead006d19b7d23d0a369e9ad73
- https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4
- https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2
- https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1
- https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5889-7v45-q28m
- https://github.com/tensorflow/tensorflow/pull/55274