CVE-2022-41900

Katalog CVE

CVSS 9.8 · Critical EPSS 0,63%

Kerentanan Out-of-bounds Read pada google tensorflow. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or remote code execution. We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cherry pick this commit on TensorFlow 2.10.1.

Rincian

Terbit di NVD

18 November 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-787: Out-of-bounds Write

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/tensorflow/tensorflow/commit/216525144ee7c910296f5b05d214ca1327c9ce48 patch · advisory pihak ketiga
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xvwp-h6jv-7472 exploit · patch · advisory pihak ketiga