PT-2022-26140 · Google · Tensorflow

Published 2022-11-18 · Updated 2024-03-06 · CVE-2022-41909

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11 TensorFlow versions 2.10.1, 2.9.3, and 2.8.4

Description TensorFlow is an open source platform for machine learning. An input encoded that is not a valid CompositeTensorVariant tensor will trigger a segfault in tf.raw ops.CompositeTensorVariantToComponents.

Recommendations For TensorFlow versions prior to 2.11, update to version 2.11 or later. For TensorFlow versions 2.10.1, 2.9.3, and 2.8.4, apply the cherrypicked commit to resolve the issue. As a temporary workaround, consider validating the input encoded to ensure it is a valid CompositeTensorVariant tensor before passing it to tf.raw ops.CompositeTensorVariantToComponents.

Exploit

Fix

NULL Pointer Dereference

RCE

Weakness Enumeration

CWE-476

CWE-20

Related Identifiers

AZL-11543

BIT-TENSORFLOW-2022-41909

CVE-2022-41909

GHSA-RJX6-V474-2CH9

Affected Products

Tensorflow

References · 12

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rjx6-v474-2ch9 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41909.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/bf594d08d377dc6a3354d9fdb494b32d45f91971 · Patch
• https://github.com/tensorflow/tensorflow/commit/660ce5a89eb6766834bdc303d2ab3902aef99d3d · Patch
• https://osv.dev/vulnerability/BIT-tensorflow-2022-41909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41909 · Security Note
• https://osv.dev/vulnerability/AZL-11543 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rjx6-v474-2ch9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41909 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc · Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/53177 · Telegram Post