CVE-2022-41909: Segfault in `CompositeTensorVariantToComponents` in Tensorflow
First published: Fri Nov 18 2022(Updated: )
TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `tf.raw_ops.CompositeTensorVariantToComponents`. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Google TensorFlow | <2.8.4 | |
| Google TensorFlow | >=2.9.0<2.9.3 | |
| Google TensorFlow | =2.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/lib/core/py_func.cc
- https://github.com/tensorflow/tensorflow/commit/660ce5a89eb6766834bdc303d2ab3902aef99d3d
- https://github.com/tensorflow/tensorflow/commit/bf594d08d377dc6a3354d9fdb494b32d45f91971
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rjx6-v474-2ch9
Frequently Asked Questions
What is CVE-2022-41909?
CVE-2022-41909 is a vulnerability in TensorFlow that can trigger a segfault in certain cases.
What is the severity of CVE-2022-41909?
The severity of CVE-2022-41909 is high with a CVSS score of 7.5.
How does CVE-2022-41909 affect Google TensorFlow?
CVE-2022-41909 affects Google TensorFlow versions up to 2.8.4, 2.9.0 up to 2.9.3, and exactly 2.10.0.
How can CVE-2022-41909 be fixed?
CVE-2022-41909 can be fixed by applying the patches provided by TensorFlow in the GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d.
What actions can be taken to mitigate CVE-2022-41909?
To mitigate CVE-2022-41909, update Google TensorFlow to a version that includes the relevant patches.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/author
- agent/title
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/google
- canonical/google tensorflow
- version/google tensorflow/2.9.0
- version/google tensorflow/2.10.0