CVE-2022-35972

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-35972
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-35972.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-35972
Aliases
Downstream
Related
Published
2022-09-16T21:00:19Z
Modified
2026-04-14T12:50:07.053369Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Segfault in `QuantizedBiasAdd` in TensorFlow
Details

TensorFlow is an open source platform for machine learning. If QuantizedBiasAdd is given min_input, max_input, min_bias, max_bias tensors of a nonzero rank, it results in a segfault that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit 785d67a78a1d533759fcd2f5e8d6ef778de849e0. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "2.7.2"
                },
                {
                    "introduced": "2.8.0"
                },
                {
                    "fixed": "2.8.1"
                },
                {
                    "introduced": "2.9.0"
                },
                {
                    "fixed": "2.9.1"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-20"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35972.json"
}
References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type
GIT
Repo
https://github.com/tensorflow/tensorflow
Events
Introduced
c256c071bb26e1e13b4666d1b3e229e110bc914a
Fixed
dd7b8a3c1714d0052ce4b4a2fd8dcef927439a24
Introduced
3f878cff5b698b82eea85db2b60d65a2e320850e
Fixed
0516d4d8bced506cae97dc3cb45dbd2fe4311f26
Introduced
8a20d54a3c1bfa38c03ea99a2ad3c1b0a45dfa95
Fixed
d8ce9f9c301d021a69953134185ab728c1c248d3
Fixed
785d67a78a1d533759fcd2f5e8d6ef778de849e0
Database specific 
{
    "cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2.7.0"
        },
        {
            "fixed": "2.7.2"
        },
        {
            "introduced": "2.8.0"
        },
        {
            "fixed": "2.8.1"
        },
        {
            "introduced": "2.9.0"
        },
        {
            "fixed": "2.9.1"
        }
    ]
}

Affected versions

v2.*
v2.7.0
v2.7.1
v2.8.0
v2.9.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-35972.json"
vanir_signatures_modified 
"2026-04-14T12:50:07Z"
vanir_signatures 
[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "19973917388594441571652981069422897948",
                "191744899654295964812808385949336265097",
                "49829509598673900479122994523283448528",
                "10524939441590835699842954911867555640",
                "131245504824625449648156460059172116871",
                "239999929262041797670283293072755191297",
                "162929185244650314611548698313293068918",
                "16949902874600201737161894274953563415",
                "236177597012821085374233560878923310630",
                "156230105219112414758911575019014087328"
            ]
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/quantized_bias_add_op.cc"
        },
        "id": "CVE-2022-35972-002e1c5b",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "188364051495416936526981761359903043748",
            "length": 876.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/requantize_op_test.cc",
            "function": "TEST_F"
        },
        "id": "CVE-2022-35972-1a9a1f75",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "222948843511219579063199197669698606304",
            "length": 579.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/requantize_op_test.cc",
            "function": "TEST_F"
        },
        "id": "CVE-2022-35972-26b9484b",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "231545286619102819838887147657925245328",
            "length": 1954.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/quantized_bias_add_op_test.cc",
            "function": "TEST_F"
        },
        "id": "CVE-2022-35972-284a71b5",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "135548291945196987597641867973434118369",
            "length": 539.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/requantize_op_test.cc",
            "function": "TEST_F"
        },
        "id": "CVE-2022-35972-2f3dcfad",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "317292796833116033944099635577951215761",
                "189073502397722738725078135226802428440",
                "243363593095858951153770251998830854669",
                "90587341531786270400377640946575577364",
                "312009654865896868741981602951816343610",
                "83652780700303016952758829696903302456",
                "160225029285925092487903079334191053148",
                "317292796833116033944099635577951215761",
                "189073502397722738725078135226802428440",
                "184628447365159108962638053092937155143",
                "298530415877370286594601143039866050244",
                "35374782513452095758345973814731069880",
                "139896803297148921567571138792587053804",
                "254647064146885742992126657565348064759",
                "317292796833116033944099635577951215761",
                "189073502397722738725078135226802428440",
                "40107568457389065294035587054092060084",
                "325677379347003331688308168221734534484",
                "293972001318506120808303348797211796822",
                "124310661935370577617397760518286806241",
                "227607628773232547655971630555983787563"
            ]
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/requantize_op_test.cc"
        },
        "id": "CVE-2022-35972-59ba95f4",
        "deprecated": false
    },
    {
        "digest": {
            "function_hash": "275445589206114082439473818199213805907",
            "length": 4012.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/quantized_bias_add_op_test.cc",
            "function": "TEST_F"
        },
        "id": "CVE-2022-35972-74259570",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "331933216795139639500588753107729352085",
                "148597305191866842347014237377880133555",
                "168617365574180044031425293194180145118",
                "23610594575490751021796683404881361640",
                "97307959739404035020936678785473061802",
                "221081417132618328146004259802524552700",
                "85397369258213130740863383746526117093",
                "257803549464025866323205152649050387881"
            ]
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/quantized_instance_norm.cc"
        },
        "id": "CVE-2022-35972-7ef8c17d",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "152276762410382509261996104773020962617",
                "299647598406123106669297448427041695572",
                "149366566952871792303037254331679729368",
                "183146156192001897947884862020560569959",
                "101467942554315731014011041966626999121",
                "124045922067050002904007413734814953138",
                "332732636998222403430027369602644634138",
                "30052550059263901957462496684554554804",
                "251632449106411665270032743565000150167",
                "166270917163602469142218759538152783239",
                "288912749299579490912795440152275695299",
                "143123393234955002515514731043726636719",
                "38155641514735347921145413018270114901",
                "276220704225963841882812245401369740708",
                "199141413186206824417408317065420604164"
            ]
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/fake_quant_ops.cc"
        },
        "id": "CVE-2022-35972-859d760d",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "217818004146042196593497522992615908570",
                "176592293821506066081456611402227127500",
                "303873504397571023155792125412217191302",
                "28163283899086155569182919977301560446",
                "147956333059399788687651530650665826514",
                "49917570034920521933040804988115402767",
                "93791821315188789011355094092792374255",
                "217818004146042196593497522992615908570",
                "176592293821506066081456611402227127500",
                "303873504397571023155792125412217191302",
                "28163283899086155569182919977301560446",
                "147956333059399788687651530650665826514",
                "49917570034920521933040804988115402767",
                "93791821315188789011355094092792374255"
            ]
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/quantized_bias_add_op_test.cc"
        },
        "id": "CVE-2022-35972-9d28cf39",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "178446627728772781848845037708839535637",
                "313962621425920401144502919135357688858",
                "127255207255001102598839106959572626933",
                "180652022762734208712183193135690364059",
                "135699164362829804877382233837237651058",
                "118583936821414970937919024587845428764",
                "222651454771240675835251816826446387967",
                "224905737655865277559864986354690046294",
                "236608645661727262460254336179581919117",
                "196620079254020128840484681116888920921",
                "124555931498095722900072925181416832315"
            ]
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/tensorflow/tensorflow/commit/785d67a78a1d533759fcd2f5e8d6ef778de849e0",
        "target": {
            "file": "tensorflow/core/kernels/requantize.cc"
        },
        "id": "CVE-2022-35972-e9484610",
        "deprecated": false
    }
]