CVE-2022-41887

Katalog CVE

CVSS 7.5 · High EPSS 0,47%

Kerentanan Incorrect Calculation of Buffer Size pada google tensorflow. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` in `BinaryOp`. If the resulting dimensions overflow an `int32`, TensorFlow will crash due to a size mismatch during broadcast assignment. We have patched the issue in GitHub commit c5b30379ba87cbe774b08ac50c1f6d36df4ebb7c. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1 and 2.9.3, as these are also affected and still in supported range. However, we will not cherrypick this commit into TensorFlow 2.8.x, as it depends on Eigen behavior that changed between 2.8 and 2.9.

Rincian

Terbit di NVD

18 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-131: Incorrect Calculation of Buffer Size

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 39,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tensorflow/tensorflow/commit/c5b30379ba87cbe774b08ac50c1f6d36df4ebb7c patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8fvv-46hw-vpg3 exploit · patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/cwise_ops_common.h advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/keras/losses.py advisory pihak ketiga