VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Nov 18, 2022· Updated Apr 22, 2025

ThreadUnsafeUnigramCandidateSampler Heap out of bounds in Tensorflow

CVE-2022-41880

Description

TensorFlow is an open source platform for machine learning. When the BaseCandidateSamplerOp function receives a value in true_classes larger than range_max, a heap oob read occurs. We have patched the issue in GitHub commit b389f5c944cadfdfe599b3f1e4026e036f30d2d4. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
>= 2.10.0, < 2.10.12.10.1
tensorflow-cpuPyPI
>= 2.10.0, < 2.10.12.10.1
tensorflow-gpuPyPI
>= 2.10.0, < 2.10.12.10.1
tensorflowPyPI
< 2.8.42.8.4
tensorflow-cpuPyPI
< 2.8.42.8.4
tensorflow-gpuPyPI
< 2.8.42.8.4
tensorflowPyPI
>= 2.9.0, < 2.9.32.9.3
tensorflow-cpuPyPI
>= 2.9.0, < 2.9.32.9.3
tensorflow-gpuPyPI
>= 2.9.0, < 2.9.32.9.3

Affected products

1

Patches

1
b389f5c944ca

Add true_classes input validation for candidate sampler ops.

https://github.com/tensorflow/tensorflowAntonio SanchezOct 6, 2022via ghsa
commit
2 files changed · +30 −0
  • tensorflow/core/kernels/candidate_sampler_ops.cc+8 −0 modified
    @@ -73,6 +73,14 @@ class BaseCandidateSamplerOp : public OpKernel {
 
     gtl::ArraySlice<int64_t> true_candidate(
         true_classes.matrix<int64_t>().data(), batch_size * num_true_);
+
+    for (const auto& candidate : true_candidate) {
+      OP_REQUIRES(context, candidate >= 0 && candidate < sampler_->range(),
+                  errors::InvalidArgument("`true_candidate` out of range [", 0,
+                                          ", ", sampler_->range(),
+                                          "), received ", candidate));
+    }
+
     gtl::MutableArraySlice<int64_t> sampled_candidate(
         out_sampled_candidates->vec<int64_t>().data(), num_sampled_);
     gtl::MutableArraySlice<float> true_expected_count(
  • tensorflow/python/kernel_tests/random/candidate_sampler_ops_test.py+22 −0 modified
    @@ -18,6 +18,7 @@
 
 from tensorflow.python.framework import constant_op
 from tensorflow.python.framework import dtypes
+from tensorflow.python.framework import errors
 from tensorflow.python.framework import test_util
 from tensorflow.python.ops import array_ops
 from tensorflow.python.ops import candidate_sampling_ops
@@ -127,6 +128,27 @@ def draw(seed):
     # twice very rarely.
     self.assertLessEqual(num_same, 2)
 
+  def testCandidateOutOfRange(self):
+    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
+                                "out of range"):
+      self.evaluate(
+          candidate_sampling_ops.log_uniform_candidate_sampler(
+              true_classes=[[0, 10]],
+              num_true=2,
+              num_sampled=1000,
+              unique=False,
+              range_max=2))
+
+    with self.assertRaisesRegex((ValueError, errors.InvalidArgumentError),
+                                "out of range"):
+      self.evaluate(
+          candidate_sampling_ops.log_uniform_candidate_sampler(
+              true_classes=[[0, -10]],
+              num_true=2,
+              num_sampled=1000,
+              unique=False,
+              range_max=2))
+
 
 if __name__ == "__main__":
   test.main()

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.