CVE-2022-41902 - Out of bounds write in grappler in Tensorflow

Back Back to CVE browser

CRITICAL

Out of bounds write in grappler in Tensorflow

Published Dec 6, 2022

9.1

CRITICAL

CVSS 3.1

EPSS 0.49%

Description

TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1.

Affected products

Vendor TensorFlow Product TensorFlow Default
n/a
- Version
  < 2.8.4
  Status
  affected
  Constraints
  -
- Version
  >= 2.10.0, < 2.10.1
  Status
  affected
  Constraints
  -
- Version
  >= 2.9.0, < 2.9.3
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

TensorFlow

n/a

Version	Status	Constraints
< 2.8.4	affected	-
>= 2.10.0, < 2.10.1	affected	-
>= 2.9.0, < 2.9.3	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7310
Advisory
https://github.com/advisories/GHSA-cg88-rpvp-cjv5
Advisory
https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221
Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/a65411a1d69edfb16b25907ffb8f73556ce36bb7
PatchThird Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cg88-rpvp-cjv5
PatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41902

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-7310		Advisory
https://github.com/advisories/GHSA-cg88-rpvp-cjv5		Advisory
https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/grappler/utils/functions.cc#L221		Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/a65411a1d69edfb16b25907ffb8f73556ce36bb7		PatchThird Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-cg88-rpvp-cjv5		PatchThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-41902