CVE-2022-41884

18.11.2022, 22:15

TensorFlow is an open source platform for machine learning. If a numpy array is created with a shape such that one element is zero and the others sum to a large number, an error will be raised. We have patched the issue in GitHub commit 2b56169c16e375c521a3bc8ea658811cc0793784. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
GitHub_M	CNA	4.8 MEDIUM	NETWORK	HIGH	LOW	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 25%

Affected Products (NVD)

Vendor	Product	Version
google	tensorflow	𝑥 < 2.8.4
google	tensorflow	2.9.0 ≤ 𝑥 < 2.9.3
google	tensorflow	2.10.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
tensorflow	tensorflow	𝑥 < 2.8.4	CNA

Azure Linux Releases

Azure Package

Release

tensorflow

CBL-Mariner 2.0

0:2.11.0-1.cm2

fixed

Known Exploits!

Common Weakness Enumeration

CWE-670 - Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

References

https://github.com/tensorflow/tensorflow/commit/2b56169c16e375c521a3bc8ea658811cc0793784

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jq6x-99hj-q636

https://github.com/tensorflow/tensorflow/commit/2b56169c16e375c521a3bc8ea658811cc0793784

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jq6x-99hj-q636