CVE-2022-41910
published 2022-12-06CVE-2022-41910: TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and…
PriorityP341critical9.1CVSS 3.1
AVNACLPRNUINSUCHINAH
EPSS
0.40%
32.4th percentile
TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | < 2.8.4 | 2.8.4 | |
| tensorflow | — | — | |
| tensorflow | >= 2.9.0 < 2.9.3 | 2.9.3 | |
| intel | optimization_for_tensorflow | >= 0 < 2.8.4 | 2.8.4 |
| intel | optimization_for_tensorflow | >= 2.10.0 < 2.10.1 | 2.10.1 |
| intel | optimization_for_tensorflow | >= 2.9.0 < 2.9.3 | 2.9.3 |
| tensorflow | tensorflow | < 2.8.4 | 2.8.4 |
| tensorflow | tensorflow | — | — |
| tensorflow | tensorflow | — | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
vendor_debian4.8LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Heap overflow in `QuantizeAndDequantizeV2`
osv·2022-11-21
CVE-2022-41910 [MEDIUM] Heap overflow in `QuantizeAndDequantizeV2`
Heap overflow in `QuantizeAndDequantizeV2`
### Impact
The function [MakeGrapplerFunctionItem](https://https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221) takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered.
```python
import tensorflow as tf
@tf.function
def test():
tf.raw_ops.QuantizeAndDequantizeV2(input=[2.5],
input_min=[1.0],
input_max=[10.0],
signed_input=True,
num_bits=1,
range_given=True,
round_mode='HALF_TO_EVEN',
narrow_range=True,
axis=0x7fffffff)
test()
```
### Patches
We have patched the issue in GitHub commit [7b174a0f2e40ff3f3aa957aecddfd5aaae35eccb](https://github.com/tensorflow/tensorf
GHSA
Heap overflow in `QuantizeAndDequantizeV2`
ghsa·2022-11-21
CVE-2022-41910 [MEDIUM] CWE-125 Heap overflow in `QuantizeAndDequantizeV2`
Heap overflow in `QuantizeAndDequantizeV2`
### Impact
The function [MakeGrapplerFunctionItem](https://https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221) takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered.
```python
import tensorflow as tf
@tf.function
def test():
tf.raw_ops.QuantizeAndDequantizeV2(input=[2.5],
input_min=[1.0],
input_max=[10.0],
signed_input=True,
num_bits=1,
range_given=True,
round_mode='HALF_TO_EVEN',
narrow_range=True,
axis=0x7fffffff)
test()
```
### Patches
We have patched the issue in GitHub commit [7b174a0f2e40ff3f3aa957aecddfd5aaae35eccb](https://github.com/tensorflow/tensorf
Debian
CVE-2022-41910: tensorflow - TensorFlow is an open source platform for machine learning. The function MakeGra...
vendor_debian·2022·CVSS 4.8
CVE-2022-41910 [MEDIUM] CVE-2022-41910: tensorflow - TensorFlow is an open source platform for machine learning. The function MakeGra...
TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1.
Scope: local
forky: resolved
sid: resolved
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221https://github.com/tensorflow/tensorflow/commit/a65411a1d69edfb16b25907ffb8f73556ce36bb7https://github.com/tensorflow/tensorflow/security/advisories/GHSA-frqp-wp83-qggvhttps://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221https://github.com/tensorflow/tensorflow/commit/a65411a1d69edfb16b25907ffb8f73556ce36bb7https://github.com/tensorflow/tensorflow/security/advisories/GHSA-frqp-wp83-qggv
2022-12-06
Published