PT-2022-26121 · Google · Tensorflow

Pattarakrit Rattankul · Published 2022-11-18 · Updated 2024-03-06 · CVE-2022-41890

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4

Description The issue arises when BCast::ToShape is given input larger than an int32, causing it to crash despite being supposed to handle up to an int64. An example of this can be seen in tf.experimental.numpy.outer by passing large input to the input b.

Recommendations For TensorFlow versions prior to 2.11, update to version 2.11 or later. For TensorFlow versions 2.10.1, 2.9.3, and 2.8.4, apply the patch from GitHub commit 8310bf8dd188ff780e7fc53245058215a05bdbe5. As a temporary workaround, consider avoiding large inputs to BCast::ToShape until the issue is resolved.

Exploit

Fix

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

AZL-11529

BIT-TENSORFLOW-2022-41890

CVE-2022-41890

GHSA-H246-CGH4-7475

Affected Products

Tensorflow

References · 11

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h246-cgh4-7475 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41890.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/8310bf8dd188ff780e7fc53245058215a05bdbe5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-41890 · Security Note
• https://osv.dev/vulnerability/GHSA-h246-cgh4-7475 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41890 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-41890 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-11529 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/53186 · Telegram Post