CVE-2022-29212
Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter.
Does this matter?
Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.
Description
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling. Thus, since code was calling `QuantizeMultiplierSmallerThanOneExp`, the `TFLITE_CHECK_LT` assertion would trigger and abort the process. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.32% probability · 25th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- google/tensorflow
- Source
- security-advisories@github.com
References
- https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/lite/kernels/internal/quantization_util.cc#L114-L123Third Party Advisory
- https://github.com/tensorflow/tensorflow/commit/a989426ee1346693cc015792f11d715f6944f2b8Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/issues/43661Exploit, Issue Tracking, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8wwm-6264-x792Exploit, Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/lite/kernels/internal/quantization_util.cc#L114-L123Third Party Advisory
- https://github.com/tensorflow/tensorflow/commit/a989426ee1346693cc015792f11d715f6944f2b8Patch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/issues/43661Exploit, Issue Tracking, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.6.4Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.7.2Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0Release Notes, Third Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8wwm-6264-x792Exploit, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.