PyPI: tensorflow
CVE-2022-41889
Safety vulnerability ID: SFTY-20221118-05423
Safety legacy ID: pyup.io-51948
Tensorflow 2.8.4, 2.9.3 and 2.10.1 include a fix for CVE-2022-41889: If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a 'nullptr', which is not caught. An example can be seen in 'tf.compat.v1.extract_volume_patches' by passing in quantized tensors as input 'ksizes'. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xxcj-rhqg-m46g
Overview
Segfault via invalid attributes in `pywrap_tfe_src.cc`
Advisory
Tensorflow 2.8.4, 2.9.3 and 2.10.1 include a fix for CVE-2022-41889: If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a 'nullptr', which is not caught. An example can be seen in 'tf.compat.v1.extract_volume_patches' by passing in quantized tensors as input 'ksizes'. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xxcj-rhqg-m46g
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20221118-05423/CVE-2022-41889
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xxcj-rhqg-m46g
- https://nvd.nist.gov/vuln/detail/CVE-2022-41889
- https://github.com/tensorflow/tensorflow/commit/e9e95553e5411834d215e6770c81a83a3d0866ce
- https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/image/generate_box_proposals_op.cu.cc
- https://github.com/advisories/GHSA-xxcj-rhqg-m46g
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more