PT-2022-26116 · Google · Tensorflow

Neophytos Christou · Published 2022-11-18 · Updated 2024-03-06 · CVE-2022-41885

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4

Description TensorFlow is an open source platform for machine learning. When tf.raw ops.FusedResizeAndPadConv2D is given a large tensor shape, it overflows.

Recommendations For TensorFlow versions prior to 2.11, update to version 2.11 or later. For TensorFlow versions 2.10.1, 2.9.3, and 2.8.4, apply the patch from GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. As a temporary workaround, consider avoiding the use of tf.raw ops.FusedResizeAndPadConv2D with large tensor shapes until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-131

Related Identifiers

BIT-TENSORFLOW-2022-41885

CVE-2022-41885

GHSA-762H-VPVW-3RCX

Affected Products

Tensorflow

References · 10

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-762h-vpvw-3rcx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41885.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/d66e1d568275e6a2947de97dca7a102a211e01ce · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2022-41885 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41885 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41885 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-762h-vpvw-3rcx · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/conv_ops_fused_image_transform.cc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/53189 · Telegram Post