PyPI: tensorflow-macos
CVE-2022-41883
Safety vulnerability ID: SFTY-20221118-13767
Safety legacy ID: pyup.io-58263
Tensorflow-macos 2.10.1 includes a fix for CVE-2022-41883: When ops that have specified input sizes receive a differing number of inputs, the executor will crash. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-w58w-79xv-6vcj
Overview
Out of bounds segmentation fault due to unequal op inputs in Tensorflow
Advisory
Tensorflow-macos 2.10.1 includes a fix for CVE-2022-41883: When ops that have specified input sizes receive a differing number of inputs, the executor will crash. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-w58w-79xv-6vcj
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20221118-13767/CVE-2022-41883
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-w58w-79xv-6vcj
- https://nvd.nist.gov/vuln/detail/CVE-2022-41883
- https://github.com/tensorflow/tensorflow/commit/f5381e0e10b5a61344109c1b7c174c68110f7629
- https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/dynamic_stitch_op.cc
- https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/data_flow_ops.cc
- https://github.com/advisories/GHSA-w58w-79xv-6vcj
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more