PyPI: tensorflow-macos
CVE-2022-41890
Safety vulnerability ID: SFTY-20221118-93062
Safety legacy ID: pyup.io-58276
Tensorflow-macos 2.8.4, 2.9.3 and 2.10.1 include a fix for CVE-2022-41890: If 'BCast::ToShape' is given input larger than an 'int32', it will crash, despite being supposed to handle up to an 'int64'. An example can be seen in 'tf.experimental.numpy.outer' by passing in large input to the input 'b'. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h246-cgh4-7475
Overview
`CHECK` fail in `BCast` overflow
Advisory
Tensorflow-macos 2.8.4, 2.9.3 and 2.10.1 include a fix for CVE-2022-41890: If 'BCast::ToShape' is given input larger than an 'int32', it will crash, despite being supposed to handle up to an 'int64'. An example can be seen in 'tf.experimental.numpy.outer' by passing in large input to the input 'b'. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h246-cgh4-7475
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20221118-93062/CVE-2022-41890
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h246-cgh4-7475
- https://nvd.nist.gov/vuln/detail/CVE-2022-41890
- https://github.com/tensorflow/tensorflow/commit/8310bf8dd188ff780e7fc53245058215a05bdbe5
- https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h
- https://github.com/advisories/GHSA-h246-cgh4-7475
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more