PT-2022-26112 · Google · Tensorflow

Yu Tian · Published 2022-11-18 · Updated 2024-03-06 · CVE-2022-41880

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4

Description The issue occurs when the BaseCandidateSamplerOp function receives a value in true classes larger than range max, resulting in a heap out-of-bounds read. This can be triggered by calling the tf.raw ops.ThreadUnsafeUnigramCandidateSampler function with a true classes value exceeding the range max parameter.

Recommendations For TensorFlow versions prior to 2.11, update to version 2.11 or later. For TensorFlow version 2.10.1, apply the patch from GitHub commit b389f5c944cadfdfe599b3f1e4026e036f30d2d4. For TensorFlow version 2.9.3, apply the patch from GitHub commit b389f5c944cadfdfe599b3f1e4026e036f30d2d4. For TensorFlow version 2.8.4, apply the patch from GitHub commit b389f5c944cadfdfe599b3f1e4026e036f30d2d4. As a temporary workaround, consider restricting the input values for true classes to prevent them from exceeding the range max value.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

AZL-11524

BIT-TENSORFLOW-2022-41880

CVE-2022-41880

GHSA-8W5G-3WCV-9G2J

Affected Products

Tensorflow

References · 11

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8w5g-3wcv-9g2j · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41880.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/b389f5c944cadfdfe599b3f1e4026e036f30d2d4 · Patch
• https://osv.dev/vulnerability/AZL-11524 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8w5g-3wcv-9g2j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41880 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-41880 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41880 · Security Note
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/candidate_sampler_ops.cc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/53180 · Telegram Post