CVE-2022-41885
Overflow in `FusedResizeAndPadConv2D` in Tensorflow
- State
- Published
- Severity
- 4.8 Medium
- Published
- Nov 18, 2022
- Updated
- Apr 22, 2025
- Reserved
- Sep 30, 2022
Description
TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patched the issue in GitHub commit d66e1d568275e6a2947de97dca7a102a211e01ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.8 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H | GitHub_M |
Weaknesses
- CWE-131 Incorrect Calculation of Buffer Size
Affected Products
| Product | Versions |
|---|---|
tensorflowtensorflow |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.