CVE-2022-41900

FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in Tensorflow

State: Published
Severity: 7.1 High
Published: Nov 18, 2022
Updated: Apr 22, 2025
Reserved: Sep 30, 2022

Description

TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers using Tensorflow can exploit the vulnerability. They can access heap memory which is not in the control of user, leading to a crash or remote code execution. We have patched the issue in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. The fix will be included in TensorFlow 2.11.0. We will also cherry pick this commit on TensorFlow 2.10.1.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-787 Out-of-bounds Write
CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
tensorflowtensorflow	>= 2.10.0, < 2.10.1Affected >= 2.9.0, < 2.9.3Affected < 2.8.4Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.