VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Nov 18, 2022· Updated Apr 22, 2025

`CHECK` fail via inputs in `SdcaOptimizer` in Tensorflow

CVE-2022-41899

Description

TensorFlow is an open source platform for machine learning. Inputs dense_features or example_state_data not of rank 2 will trigger a CHECK fail in SdcaOptimizer. We have patched the issue in GitHub commit 80ff197d03db2a70c6a111f97dcdacad1b0babfa. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.8.42.8.4
tensorflowPyPI
>= 2.9.0, < 2.9.32.9.3
tensorflowPyPI
>= 2.10.0, < 2.10.12.10.1
tensorflow-cpuPyPI
< 2.8.42.8.4
tensorflow-gpuPyPI
< 2.8.42.8.4
tensorflow-cpuPyPI
>= 2.9.0, < 2.9.32.9.3
tensorflow-gpuPyPI
>= 2.9.0, < 2.9.32.9.3
tensorflow-cpuPyPI
>= 2.10.0, < 2.10.12.10.1
tensorflow-gpuPyPI
>= 2.10.0, < 2.10.12.10.1

Affected products

1

Patches

1
80ff197d03db

Fix SDCA optimizer crash.

https://github.com/tensorflow/tensorflowAntonio SanchezSep 30, 2022via ghsa
commit
2 files changed · +12 −0
  • tensorflow/core/kernels/sdca_internal.cc+7 −0 modified
    @@ -389,6 +389,13 @@ Status Examples::Initialize(OpKernelContext* const context,
   OpInputList dense_features_inputs;
   TF_RETURN_IF_ERROR(
       context->input_list("dense_features", &dense_features_inputs));
+  for (int i = 0; i < dense_features_inputs.size(); ++i) {
+    if (!TensorShapeUtils::IsMatrix(dense_features_inputs[i].shape())) {
+      return errors::InvalidArgument("Dense features at index ", i,
+                                     " must be rank 2 but is rank ",
+                                     dense_features_inputs[i].dims());
+    }
+  }
 
   examples_.clear();
   examples_.resize(num_examples);
  • tensorflow/core/kernels/sdca_ops.cc+5 −0 modified
    @@ -49,6 +49,7 @@ limitations under the License.
 #include "tensorflow/core/lib/core/status.h"
 #include "tensorflow/core/lib/core/stringpiece.h"
 #include "tensorflow/core/lib/gtl/inlined_vector.h"
+#include "tensorflow/core/platform/errors.h"
 #include "tensorflow/core/platform/fingerprint.h"
 #include "tensorflow/core/platform/macros.h"
 #include "tensorflow/core/platform/mutex.h"
@@ -142,6 +143,10 @@ void DoCompute(const ComputeOptions& options, OpKernelContext* const context) {
   const Tensor* example_state_data_t;
   OP_REQUIRES_OK(context,
                  context->input("example_state_data", &example_state_data_t));
+  OP_REQUIRES(
+      context, TensorShapeUtils::IsMatrix(example_state_data_t->shape()),
+      errors::InvalidArgument("example_state_data must be rank 2 but is rank ",
+                              example_state_data_t->dims()));
   TensorShape expected_example_state_shape({examples.num_examples(), 4});
   OP_REQUIRES(context,
               example_state_data_t->shape() == expected_example_state_shape,

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.