PT-2022-26120 · Google · Tensorflow

Pattarakrit Rattankul · Published 2022-11-18 · Updated 2025-01-15 · CVE-2022-41889

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1 and earlier TensorFlow versions 2.9.3 and earlier TensorFlow versions 2.8.4 and earlier

Description TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a nullptr, which is not caught. An example can be seen in tf.compat.v1.extract volume patches by passing in quantized tensors as input ksizes.

Recommendations For versions prior to 2.11, update to TensorFlow 2.11 or later. For versions 2.10.1 and earlier, update to TensorFlow 2.10.1 or later. For versions 2.9.3 and earlier, update to TensorFlow 2.9.3 or later. For versions 2.8.4 and earlier, update to TensorFlow 2.8.4 or later. As a temporary workaround, consider avoiding the use of quantized tensors as input ksizes in tf.compat.v1.extract volume patches until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

AZL-11528

BIT-TENSORFLOW-2022-41889

CVE-2022-41889

GHSA-XXCJ-RHQG-M46G

Affected Products

Tensorflow

References · 12

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xxcj-rhqg-m46g · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41889.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/e9e95553e5411834d215e6770c81a83a3d0866ce · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41889 · Security Note
• https://osv.dev/vulnerability/AZL-11528 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-41889 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41889 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xxcj-rhqg-m46g · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/generate_box_proposals_op.cu.cc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/53176 · Telegram Post
• https://t.me/cvenotify/107492 · Telegram Post