Vulnerabilities > CVE-2022-29200 - Improper Validation of Specified Quantity in Input vulnerability in Google Tensorflow

Summary

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate the ranks of any of the arguments to this API call. This results in `CHECK`-failures when the elements of the tensor are accessed. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Vulnerable Configurations

Common Weakness Enumeration (CWE)

• CWE-1284 - Improper Validation of Specified Quantity in Input

References