CVE-2022-41880 ThreadUnsafeUnigramCandidateSampler Heap out of bounds in Tensorflow

🗓️ 18 Nov 2022 00:00:00Reported by GitHub_MType

vulnrichment🔗 github.com👁 7 Views

Patch for CVE-2022-41880 resolves heap out of bounds issue in TensorFlow BaseCandidateSamplerOp function.

Reporter	Title	Published	Views	Family All 34
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to multiple vulerabilities in TensorFlow	6 Jul 202317:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in TensorFlow	30 Jan 202317:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak.	2 Feb 202303:37	–	ibm
IBM Security Bulletins	Security Bulletin: tensorflow-2.7.3-cp37 vulnerable to CVE-2022-41911 CVE-2022-41907 CVE-2022-41908 CVE-2022-41896 CVE-2022-41891 CVE-2022-41894 CVE-2022-41884 IBM Maximo Application Suite - Monitor Component	6 Jun 202321:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	15 Dec 202203:09	–	ibm
CBLMariner	CVE-2022-41880 affecting package tensorflow for versions less than 2.11.0-1	9 Dec 202220:03	–	cbl_mariner
Circl	CVE-2022-41880	19 Nov 202200:29	–	circl
CNNVD	Google TensorFlow 缓冲区错误漏洞	18 Nov 202200:00	–	cnnvd
CNVD	Google TensorFlow BaseCandidateSamplerOp Buffer Error Vulnerability	23 Nov 202200:00	–	cnvd
CVE	CVE-2022-41880	18 Nov 202200:00	–	cve

Source	Link
github	www.github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/candidate_sampler_ops.cc
github	www.github.com/tensorflow/tensorflow/commit/b389f5c944cadfdfe599b3f1e4026e036f30d2d4
github	www.github.com/tensorflow/tensorflow/security/advisories/GHSA-8w5g-3wcv-9g2j

18 Nov 2022 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 3.16.8

EPSS0.0041

SSVC

cve 2022 41880 tensorflow heap out of bounds basecandidatesamplerop github patch supported versions