CVE-2022-41909: Segfault in `CompositeTensorVariantToComponents` in Tensorflow
TensorFlow is an open source platform for machine learning. An input encoded that is not a valid CompositeTensorVariant tensor will trigger a segfault in tf.rawops.CompositeTensorVariantToComponents. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.11Patch bf594d08d377dc6a3354d9fdb494b32d45f91971 - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.11Patch 660ce5a89eb6766834bdc303d2ab3902aef99d3d - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.10.1Patch bf594d08d377dc6a3354d9fdb494b32d45f91971 - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.10.1Patch 660ce5a89eb6766834bdc303d2ab3902aef99d3d - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.9.3Patch bf594d08d377dc6a3354d9fdb494b32d45f91971 - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.9.3Patch 660ce5a89eb6766834bdc303d2ab3902aef99d3d - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.8.4Patch bf594d08d377dc6a3354d9fdb494b32d45f91971 - Upgrade
Upgrade
TensorFlowto a version that resolves this vulnerability.Fixed in 2.8.4Patch 660ce5a89eb6766834bdc303d2ab3902aef99d3d
Event History
Frequently Asked Questions
What is CVE-2022-41909?
CVE-2022-41909 is a vulnerability in TensorFlow that can trigger a segfault in certain cases.
What is the severity of CVE-2022-41909?
The severity of CVE-2022-41909 is high with a CVSS score of 7.5.
How does CVE-2022-41909 affect Google TensorFlow?
CVE-2022-41909 affects Google TensorFlow versions up to 2.8.4, 2.9.0 up to 2.9.3, and exactly 2.10.0.
How can CVE-2022-41909 be fixed?
CVE-2022-41909 can be fixed by applying the patches provided by TensorFlow in the GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d.
What actions can be taken to mitigate CVE-2022-41909?
To mitigate CVE-2022-41909, update Google TensorFlow to a version that includes the relevant patches.