PT-2022-26119 · Google · Tensorflow

Pattarakrit Rattankul · Published 2022-11-18 · Updated 2024-03-06 · CVE-2022-41888

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4

Description TensorFlow is an open source platform for machine learning. When running on GPU, the function tf.image.generate bounding box proposals receives a scores input that must be of rank 4 but is not checked.

Recommendations For TensorFlow versions prior to 2.11, update to version 2.11 or later. For TensorFlow versions 2.10.1, 2.9.3, and 2.8.4, apply the patch from GitHub commit cf35502463a88ca7185a99daa7031df60b3c1c98. As a temporary workaround, consider validating the rank of the scores input before passing it to tf.image.generate bounding box proposals.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

AZL-11527

BIT-TENSORFLOW-2022-41888

CVE-2022-41888

GHSA-6X99-GV2V-Q76V

Affected Products

Tensorflow

References · 11

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6x99-gv2v-q76v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41888.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/cf35502463a88ca7185a99daa7031df60b3c1c98 · Patch
• https://osv.dev/vulnerability/CVE-2022-41888 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-41888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41888 · Security Note
• https://osv.dev/vulnerability/GHSA-6x99-gv2v-q76v · Vendor Advisory
• https://osv.dev/vulnerability/AZL-11527 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/generate_box_proposals_op.cu.cc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/53174 · Telegram Post