CVE-2022-29209
MEDIUMCVSS 5.5/10EPSS 0.39%
Last modified
CVE-2022-29209 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.) have an incorrect logic when comparing `size_t` and `int` values. EPSS estimates a 0.39% chance of exploitation in the next 30 days.
Description
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.) have an incorrect logic when comparing `size_t` and `int` values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Tensorflow | < 2.6.4 | — | |
| Tensorflow | >= 2.7.0, < 2.7.2 | — | |
| Tensorflow | 2.7.0 | Rc0 | |
| Tensorflow | 2.8.0 | — | |
| Tensorflow | 2.9.0 | Rc0 |
References
- https://github.com/tensorflow/tensorflow/commit/b917181c29b50cb83399ba41f4d938dc369109a1Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/issues/55530Exploit, Issue Tracking, Third Party Advisory
- https://github.com/tensorflow/tensorflow/pull/55730Exploit, Issue Tracking, Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4rr-5m7v-wxcwExploit, Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/commit/b917181c29b50cb83399ba41f4d938dc369109a1Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/issues/55530Exploit, Issue Tracking, Third Party Advisory
- https://github.com/tensorflow/tensorflow/pull/55730Exploit, Issue Tracking, Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f4rr-5m7v-wxcwExploit, Patch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-29209?
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.) have an incorrect logic when comparing `size_t` and `int` values. Due to type conversion rules, several of the macros would trigger incorrectly. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
How severe is CVE-2022-29209?
CVE-2022-29209 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.39% probability of exploitation in the next 30 days.
How do I fix CVE-2022-29209?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-29203TensorFlow is an open source platform for machine learning. …5.5
- CVE-2022-29204TensorFlow is an open source platform for machine learning. …5.5
- CVE-2022-29205TensorFlow is an open source platform for machine learning. …5.5
- CVE-2022-29206TensorFlow is an open source platform for machine learning. …5.5
- CVE-2022-29207TensorFlow is an open source platform for machine learning. …5.5
- CVE-2022-29208TensorFlow is an open source platform for machine learning. …7.1
- CVE-2022-2921Exposure of Private Personal Information to an Unauthorized …8.8
- CVE-2022-29210TensorFlow is an open source platform for machine learning. …5.5
- CVE-2022-29211TensorFlow is an open source platform for machine learning. …5.5
- CVE-2022-29212TensorFlow is an open source platform for machine learning. …5.5
- CVE-2022-29213TensorFlow is an open source platform for machine learning. …5.5
- CVE-2022-29214NextAuth.js (next-auth) is am open source authentication sol…6.1
Are you affected by CVE-2022-29209?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST