PT-2022-26133 · Google · Tensorflow

Kang Hong Jin · Published 2022-11-18 · Updated 2024-03-06 · CVE-2022-41901

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow version 2.10.1 TensorFlow version 2.9.3 TensorFlow version 2.8.4

Description TensorFlow is an open source platform for machine learning. An input sparse matrix that is not a matrix with a shape with rank 0 will trigger a CHECK fail in tf.raw ops.SparseMatrixNNZ.

Recommendations For TensorFlow versions prior to 2.11, update to version 2.11 or later. For TensorFlow version 2.10.1, apply the patch from GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693 or update to a later version. For TensorFlow version 2.9.3, apply the patch from GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693 or update to a later version. For TensorFlow version 2.8.4, apply the patch from GitHub commit f856d02e5322821aad155dad9b3acab1e9f5d693 or update to a later version.

Exploit

Fix

Assertion Failure

RCE

Weakness Enumeration

CWE-617

CWE-20

Related Identifiers

AZL-11540

BIT-TENSORFLOW-2022-41901

CVE-2022-41901

GHSA-G9FM-R5MM-RF9F

Affected Products

Tensorflow

References · 11

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-g9fm-r5mm-rf9f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41901.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/f856d02e5322821aad155dad9b3acab1e9f5d693 · Patch
• https://osv.dev/vulnerability/GHSA-g9fm-r5mm-rf9f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41901 · Security Note
• https://osv.dev/vulnerability/AZL-11540 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-41901 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41901 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/sparse/sparse_matrix.h · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/53190 · Telegram Post