Vulnerability Description
TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read is triggered. This issue has been patched in GitHub commit 595a65a3e224a0362d7e68c2213acfc2b499a196. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tensorflow | >= 2.7.0, < 2.7.2 |
Related Weaknesses (CWE)
References
- https://github.com/tensorflow/tensorflow/blob/f463040eb3997e42e60a2ffc6dc72de7efThird Party Advisory
- https://github.com/tensorflow/tensorflow/commit/595a65a3e224a0362d7e68c2213acfc2PatchThird Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pxrw-j2fv-hx3hPatchThird Party Advisory
- https://github.com/tensorflow/tensorflow/blob/f463040eb3997e42e60a2ffc6dc72de7efThird Party Advisory
- https://github.com/tensorflow/tensorflow/commit/595a65a3e224a0362d7e68c2213acfc2PatchThird Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pxrw-j2fv-hx3hPatchThird Party Advisory
FAQ
What is CVE-2022-35937?
CVE-2022-35937 is a vulnerability with a CVSS score of 7.0 (HIGH). TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the...
How severe is CVE-2022-35937?
CVE-2022-35937 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-35937?
Check the references section above for vendor advisories and patch information. Affected products include: Google Tensorflow.