PyPI: intel-tensorflow
CVE-2022-41890
Safety vulnerability ID: SFTY-20221118-92468
Safety legacy ID: pyup.io-56633
Intel-tensorflow 2.8.4, 2.9.3 and 2.10.1 include a fix for CVE-2022-41890: If 'BCast::ToShape' is given input larger than an 'int32', it will crash, despite being supposed to handle up to an 'int64'. An example can be seen in 'tf.experimental.numpy.outer' by passing in large input to the input 'b'. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h246-cgh4-7475
Overview
`CHECK` fail in `BCast` overflow
Advisory
Intel-tensorflow 2.8.4, 2.9.3 and 2.10.1 include a fix for CVE-2022-41890: If 'BCast::ToShape' is given input larger than an 'int32', it will crash, despite being supposed to handle up to an 'int64'. An example can be seen in 'tf.experimental.numpy.outer' by passing in large input to the input 'b'. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h246-cgh4-7475
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20221118-92468/CVE-2022-41890
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h246-cgh4-7475
- https://nvd.nist.gov/vuln/detail/CVE-2022-41890
- https://github.com/tensorflow/tensorflow/commit/8310bf8dd188ff780e7fc53245058215a05bdbe5
- https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h
- https://github.com/advisories/GHSA-h246-cgh4-7475
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more