CVE-2022-41890 — Incorrect Type Conversion or Cast in Tensorflow

CWE-704 — Incorrect Type Conversion or Cast6 documents6 sources
Severity
7.5HIGHNVD
CNA4.8
EPSS
0.1%
top 66.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
TensorflowGoogle TensorflowIntel Optimization FOR Tensorflow
Timeline
PublishedNov 18
Latest updateNov 21

Description

TensorFlow is an open source platform for machine learning. If `BCast::ToShape` is given input larger than an `int32`, it will crash, despite being supposed to handle up to an `int64`. An example can be seen in `tf.experimental.numpy.outer` by passing in large input to the input `b`. We have patched the issue in GitHub commit 8310bf8dd188ff780e7fc53245058215a05bdbe5. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDgoogle/tensorflow2.9.0 — 2.9.3+2
▶CVEListV5tensorflow/tensorflow< 2.8.4+2
▶PyPIintel/optimization_for_tensorflow2.9.0 — 2.9.3+2

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
`CHECK` fail in `BCast` overflow↗2022-11-21
▶
OSV
`CHECK` fail in `BCast` overflow↗2022-11-21
▶
CVEList
`CHECK` fail in `BCast` overflow in Tensorflow↗2022-11-18
▶

📋Vendor Advisories

2
Microsoft
`CHECK` fail in `BCast` overflow in Tensorflow↗2022-11-08
▶
Debian
CVE-2022-41890: tensorflow - TensorFlow is an open source platform for machine learning. If `BCast::ToShape` ...↗2022
▶
CVE-2022-41890 — Incorrect Type Conversion or Cast | cvebase