VYPR
← All advisories
Moderate severityNVD Advisory· Published Dec 6, 2022· Updated Apr 23, 2025

Heap out of bounds read in `QuantizeAndDequantizeV2` in Tensorflow

CVE-2022-41910

Description

TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. We have patched the issue in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7. The fix will be included in TensorFlow 2.11.0. We will also cherrypick this commit on TensorFlow 2.8.4, 2.9.3, and 2.10.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.8.42.8.4
tensorflowPyPI
>= 2.9.0, < 2.9.32.9.3
tensorflowPyPI
>= 2.10.0, < 2.10.12.10.1
tensorflow-cpuPyPI
< 2.8.42.8.4
tensorflow-gpuPyPI
< 2.8.42.8.4
tensorflow-cpuPyPI
>= 2.9.0, < 2.9.32.9.3
tensorflow-gpuPyPI
>= 2.9.0, < 2.9.32.9.3
tensorflow-cpuPyPI
>= 2.10.0, < 2.10.12.10.1
tensorflow-gpuPyPI
>= 2.10.0, < 2.10.12.10.1

Affected products

1

Patches

1
a65411a1d69e

Fix OOB write in grappler.

https://github.com/tensorflow/tensorflowMihai MaruseacOct 19, 2022via ghsa
commit
1 file changed · +5 −0
  • tensorflow/core/grappler/utils/functions.cc+5 −0 modified
    @@ -291,6 +291,11 @@ Status MakeGrapplerFunctionItem(const FunctionDef& func,
 
   std::vector<const FunctionDef::ArgAttrs*> arg_attr(inputs.size(), nullptr);
   for (const auto& attr : func.arg_attr()) {
+    if (attr.first >= inputs.size()) {
+      return errors::InvalidArgument("Invalid attribute index, got ",
+                                     attr.first, " but expected less than ",
+                                     inputs.size());
+    }
     arg_attr.at(attr.first) = &attr.second;
   }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.