CVE-2022-35938

Advisory

A vulnerability in TensorFlow's `GatherNd` function can trigger an out-of-bounds memory read or crash when inputs exceed output sizes. This issue is resolved in a GitHub commit, which will be included in an upcoming TensorFlow release. Additionally, the fix will be applied to several previous versions that are still under support. This vulnerability has no known workarounds, so updating to a patched version is recommended.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/tensorflow/tflite-micro/pull/1286
• https://github.com/tensorflow/tflite-micro/commit/4142e47e9e31db481781b955ed3ff807a781b494
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35938