Vulnerability Description
TensorFlow is an open source platform for machine learning. The `ScatterNd` function takes an input argument that determines the indices of of the output tensor. An input index greater than the output tensor or less than zero will either write content at the wrong index or trigger a crash. We have patched the issue in GitHub commit b4d4b4cb019bd7240a52daa4ba61e3cc814f0384. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tensorflow | >= 2.7.0, < 2.7.2 |
Related Weaknesses (CWE)
References
- https://github.com/tensorflow/tensorflow/blob/266558ac4c1f361e9a178ee9d3f0ce2e64Third Party Advisory
- https://github.com/tensorflow/tensorflow/commit/b4d4b4cb019bd7240a52daa4ba61e3ccPatchThird Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-ffjm-4qwc-7cmfPatchThird Party Advisory
- https://github.com/tensorflow/tensorflow/blob/266558ac4c1f361e9a178ee9d3f0ce2e64Third Party Advisory
- https://github.com/tensorflow/tensorflow/commit/b4d4b4cb019bd7240a52daa4ba61e3ccPatchThird Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-ffjm-4qwc-7cmfPatchThird Party Advisory
FAQ
What is CVE-2022-35939?
CVE-2022-35939 is a vulnerability with a CVSS score of 7.0 (HIGH). TensorFlow is an open source platform for machine learning. The `ScatterNd` function takes an input argument that determines the indices of of the output tensor. An input index greater than the output...
How severe is CVE-2022-35939?
CVE-2022-35939 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-35939?
Check the references section above for vendor advisories and patch information. Affected products include: Google Tensorflow.