CVE-2022-41887

Advisory

Tensorflow-gpu 2.9.3 and 2.10.1 include a fix for CVE-2022-41887: 'tf.keras.losses.poisson' receives a 'y_pred' and 'y_true' that are passed through 'functor::mul' in 'BinaryOp'. If the resulting dimensions overflow an 'int32', TensorFlow will crash due to a size mismatch during broadcast assignment.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8fvv-46hw-vpg3

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41887
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/cwise_ops_common.h
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/python/keras/losses.py
• https://github.com/tensorflow/tensorflow/commit/c5b30379ba87cbe774b08ac50c1f6d36df4ebb7c
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8fvv-46hw-vpg3