CVE-2022-41883 — MEDIUM (6.8)

Vulnerability Description

TensorFlow is an open source platform for machine learning. When ops that have specified input sizes receive a differing number of inputs, the executor will crash. We have patched the issue in GitHub commit f5381e0e10b5a61344109c1b7c174c68110f7629. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

CVSS Score

6.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

LOW

Availability

HIGH

Affected Products

Vendor	Product	Versions
Google	Tensorflow	2.10.0

Related Weaknesses (CWE)

CWE-125

References

https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/dynThird Party Advisory
https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/data_flThird Party Advisory
https://github.com/tensorflow/tensorflow/commit/f5381e0e10b5a61344109c1b7c174c68PatchThird Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-w58w-79xv-6vcjExploitPatchThird Party Advisory
https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/dynThird Party Advisory
https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/ops/data_flThird Party Advisory
https://github.com/tensorflow/tensorflow/commit/f5381e0e10b5a61344109c1b7c174c68PatchThird Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-w58w-79xv-6vcjExploitPatchThird Party Advisory

FAQ

What is CVE-2022-41883?

CVE-2022-41883 is a vulnerability with a CVSS score of 6.8 (MEDIUM). TensorFlow is an open source platform for machine learning. When ops that have specified input sizes receive a differing number of inputs, the executor will crash. We have patched the issue in GitHub ...

How severe is CVE-2022-41883?

CVE-2022-41883 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-41883?

Check the references section above for vendor advisories and patch information. Affected products include: Google Tensorflow.