Buffer overflow in TensorFlow - CVE-2022-41910

Vulnerability identifier: #VU69907

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41910

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in QuantizeAndDequantizeV2. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.

TensorFlow
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

TensorFlow - addressed in versions 2.8.4, 2.9.3, 2.10.1, 2.11.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.2
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.1, 23.0.1

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-frqp-wp83-qggv

• Multiple vulnerabilities in TensorFlow
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data