PT-2022-26117 · Google · Tensorflow

Neophytos Christou · Published 2022-11-18 · Updated 2024-03-06 · CVE-2022-41886

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4

Description TensorFlow is an open source platform for machine learning. When tf.raw ops.ImageProjectiveTransformV2 is given a large output shape, it overflows. The issue has been patched in GitHub commit 8faa6ea692985dbe6ce10e1a3168e0bd60a723ba.

Recommendations For TensorFlow versions prior to 2.11, update to version 2.11 or later. For TensorFlow version 2.10.1, update to a version that includes the cherrypicked commit. For TensorFlow version 2.9.3, update to a version that includes the cherrypicked commit. For TensorFlow version 2.8.4, update to a version that includes the cherrypicked commit. As a temporary workaround, consider avoiding the use of tf.raw ops.ImageProjectiveTransformV2 with large output shapes until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-131

Related Identifiers

AZL-11526

BIT-TENSORFLOW-2022-41886

CVE-2022-41886

GHSA-54PP-C6PP-7FPX

Affected Products

Tensorflow

References · 11

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-54pp-c6pp-7fpx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41886.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/8faa6ea692985dbe6ce10e1a3168e0bd60a723ba · Patch
• https://osv.dev/vulnerability/GHSA-54pp-c6pp-7fpx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41886 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2022-41886 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-11526 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41886 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/image_ops.cc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/53185 · Telegram Post