PT-2022-19453 · Google · Tensorflow

Neophytos Christou

·

CVE-2022-29201

·

Published

2022-05-20

·

Updated

2026-07-09

CVSS v3.1

5.5

Medium

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.9.0 TensorFlow versions prior to 2.8.1 TensorFlow versions prior to 2.7.2 TensorFlow versions prior to 2.6.4
Description The implementation of tf.raw ops.QuantizedConv2D does not fully validate the input arguments. In this case, references get bound to nullptr for each argument that is empty.
Recommendations For versions prior to 2.9.0, update to version 2.9.0 or later. For versions prior to 2.8.1, update to version 2.8.1 or later. For versions prior to 2.7.2, update to version 2.7.2 or later. For versions prior to 2.6.4, update to version 2.6.4 or later.

Exploit

Fix

NULL Pointer Dereference

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-476CWE-20

Related Identifiers

BIT-TENSORFLOW-2022-29201
CVE-2022-29201
GHSA-PQHM-4WVF-2JG8
PYSEC-2026-1026
PYSEC-2026-3224
PYSEC-2026-3358

Affected Products

Tensorflow