CVE-2022-41889

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-41889

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-41889.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2022-41889

Aliases

Downstream

AZL-11528

Published

2022-11-18T00:00:00Z

Modified

2026-04-20T10:08:35.484407Z

Severity

5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Segfault via invalid attributes in `pywrap_tfe_src.cc` in Tensorflow

Details

TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tensor and returns a nullptr, which is not caught. An example can be seen in tf.compat.v1.extract_volume_patches by passing in quantized tensors as input ksizes. We have patched the issue in GitHub commit e9e95553e5411834d215e6770c81a83a3d0866ce. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Database specific

{
    "cwe_ids": [
        "CWE-476"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41889.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type

GIT

Repo

https://github.com/tensorflow/tensorflow

Events

Introduced

Fixed

1b8f5c396f0c016ebe81fe1af029e6f205c926a4

Introduced

8a20d54a3c1bfa38c03ea99a2ad3c1b0a45dfa95

Fixed

a5ed5f39b675a1c6f315e0caf3ad4b38478fa571

Introduced

359c3cdfc5fabac82b3c70b3b6de2b0a8c16874f

Fixed

fdfc646704c37bdf450525f6ced9d80df86e4993

Fixed

e9e95553e5411834d215e6770c81a83a3d0866ce

Database specific

{
    "source": [
        "CPE_FIELD",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.8.4"
        },
        {
            "introduced": "2.9.0"
        },
        {
            "fixed": "2.9.3"
        },
        {
            "introduced": "2.10.0"
        },
        {
            "fixed": "2.10.1"
        }
    ]
}

Affected versions

0.*

0.5.0

0.6.0

v1.*

v1.1.0-rc1

v1.1.0-rc2

v1.12.1

v1.6.0-rc1

v1.9.0-rc2

v2.*

v2.10.0

v2.8.0

v2.8.0-rc0

v2.8.0-rc1

v2.8.1

v2.8.2

v2.8.3

v2.9.0

v2.9.1

v2.9.2

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-41889.json"

vanir_signatures_modified

"2026-04-20T10:08:35Z"

vanir_signatures

[
    {
        "signature_version": "v1",
        "signature_type": "Line",
        "id": "CVE-2022-41889-3adf8e06",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "171036452484832270226014788892083232838",
                "57696147559394310183043461294278262276",
                "30466047391520012570794047594485650769",
                "276512554161449548643381055362534812465",
                "56225121513808707536432854290769080654",
                "232126389471877379879418670810841177112",
                "78699832488342486877067337055637731442"
            ]
        },
        "source": "https://github.com/tensorflow/tensorflow/commit/e9e95553e5411834d215e6770c81a83a3d0866ce",
        "target": {
            "file": "tensorflow/python/eager/pywrap_tfe_src.cc"
        },
        "deprecated": false
    },
    {
        "signature_version": "v1",
        "signature_type": "Function",
        "id": "CVE-2022-41889-943ea303",
        "digest": {
            "function_hash": "146432569913413114594583096527103738999",
            "length": 4432.0
        },
        "source": "https://github.com/tensorflow/tensorflow/commit/e9e95553e5411834d215e6770c81a83a3d0866ce",
        "target": {
            "function": "SetOpAttrList",
            "file": "tensorflow/python/eager/pywrap_tfe_src.cc"
        },
        "deprecated": false
    }
]