`CHECK` fail in `BCast` overflow
Medium4.8CVE-2022-41890 · Published Nov 21, 2022 · updated Jul 13, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| tensorflow PyPI | < 2.8.4 | 2.8.4 |
| >= 2.9.0, < 2.9.3 | 2.9.3 | |
| >= 2.10.0, < 2.10.1 | 2.10.1 |
Details and references
### Impact If [`BCast::ToShape`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h) is given input larger than an `int32`, it will crash, despite being supposed to handle up to an `int64`. An example can be seen in [`tf.experimental.numpy.outer`](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/core/util/bcast.h) by passing in large input to the input `b`. ```python import tensorflow as tf value = tf.constant(shape=[2, 1024, 1024, 1024], value=False) tf.experimental.numpy.outer(a=6,b=value) ``` ### Patches We have patched the issue in GitHub commit [8310bf8dd188ff780e7fc53245058215a05bdbe5](https://github.com/tensorflow/tensorflow/commit/8310bf8dd188ff780e7fc53245058215a05bdbe5). The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vulnerability has been reported by Pattarakrit Rattankul.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-704
- Also known as
- BIT-tensorflow-2022-41890, CVE-2022-41890, PYSEC-2026-1001, PYSEC-2026-3194, PYSEC-2026-3333
More TensorFlow advisories
All TensorFlow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 212022 | Out of bounds segmentation fault due to unequal op inputs in Tensorflow CVE-2022-41883Medium6.8fixed in 2.10.1 | Medium6.8 | 2.10.1 |
| Nov 212022 | Seg fault in `ndarray_tensor_bridge` due to zero and large inputs CVE-2022-41884Medium4.8fixed in 2.8.4, 2.9.3, 2.10.1 | Medium4.8 | 2.8.4, 2.9.3, 2.10.1 |
| Nov 212022 | Overflow in `FusedResizeAndPadConv2D` CVE-2022-41885Medium4.8fixed in 2.7.4, 2.8.1, 2.9.1 | Medium4.8 | 2.7.4, 2.8.1, 2.9.1 |
| Nov 212022 | Overflow in `ImageProjectiveTransformV2` CVE-2022-41886Medium4.8fixed in 2.8.4, 2.9.3, 2.10.1 | Medium4.8 | 2.8.4, 2.9.3, 2.10.1 |
| Nov 212022 | Overflow in `tf.keras.losses.poisson` CVE-2022-41887Medium4.8fixed in 2.9.3, 2.10.1 | Medium4.8 | 2.9.3, 2.10.1 |
| Nov 212022 | FPE in `tf.image.generate_bounding_box_proposals` CVE-2022-41888Medium4.8fixed in 2.8.4, 2.9.3, 2.10.1 | Medium4.8 | 2.8.4, 2.9.3, 2.10.1 |