Out-of-bounds read in TensorFlow - CVE-2022-41880

Vulnerability identifier: #VU80927

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-41880

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.

TensorFlow
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Maximo Application Suite
IBM Cloud Pak for Watson AIOps
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

TensorFlow - addressed in versions 2.8.4, 2.9.3, 2.10.1, 2.11.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Cloud Pak for Watson AIOps - update to 3.6.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.2
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.3
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.1, 23.0.1

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8w5g-3wcv-9g2j
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/kernels/candidate_sampler_ops.cc
• https://github.com/tensorflow/tensorflow/commit/b389f5c944cadfdfe599b3f1e4026e036f30d2d4

• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in TensorFlow