Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

TensorFlow's Machine Learning Tool Allows Hackers to Crash the System

CVE-2022-36026 · published 4 years ago
Summary

TensorFlow's machine learning tool has a security weakness that can be exploited by hackers to shut down the system. This affects users of TensorFlow versions 2.7.2, 2.8.1, 2.9.1, and 2.10.0. To stay secure, update to the latest version of TensorFlow as soon as possible.

What to do
  • Update google inc. tensorflow to version 2.7.2.
  • Update google inc. tensorflow to version 2.8.1.
  • Update google inc. tensorflow to version 2.9.1.
  • Update google tensorflow-gpu to version 2.7.2.
  • Update google tensorflow-gpu to version 2.8.1.
  • Update google tensorflow-gpu to version 2.9.1.
  • Update google inc. tensorflow-cpu to version 2.7.2.
  • Update google inc. tensorflow-cpu to version 2.8.1.
  • Update google inc. tensorflow-cpu to version 2.9.1.
Affected software
Ecosystem VendorProductAffected versions
pip google inc. tensorflow < 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
Fix: upgrade to 2.7.2
pip google tensorflow-gpu < 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
Fix: upgrade to 2.7.2
pip google inc. tensorflow-cpu < 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
Fix: upgrade to 2.7.2
– google tensorflow < 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
2.10
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Original advisory text
`CHECK` fail in `QuantizeAndDequantizeV3` in TensorFlow
TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK` fail that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit f3f9cb38ecfe5a8a703f2c4a8fead434ef291713. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-617Reachable Assertion
Timeline
Published16 Sep 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-9cr2-8pwr-fhfq · GHSA
CVE-2022-36026 · NVD
CVE-2022-36026 · OSV
Track software like this
Free during beta