CVE-2022-35938

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and outputs. If the inputs given are greater than or equal to the sizes of the outputs, an out-of-bounds memory read or a crash is triggered. This issue has been patched in GitHub commit 4142e47e9e31db481781b955ed3ff807a781b494. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
tensorflow	tensorflow	< 2.7.2; >= 2.8.0, < 2.8.1; >= 2.9.0, < 2.9.1

References

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3m3g-pf5v-5hpjPatch, Third Party Advisory
https://github.com/tensorflow/tflite-micro/blob/1bc98621180a350eb4e8d3318ea8e228c7559b37/tensorflow/lite/micro/kernels/gather_nd.cc#L143-L154Third Party Advisory
https://github.com/tensorflow/tflite-micro/commit/4142e47e9e31db481781b955ed3ff807a781b494Patch, Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-3m3g-pf5v-5hpjPatch, Third Party Advisory
https://github.com/tensorflow/tflite-micro/blob/1bc98621180a350eb4e8d3318ea8e228c7559b37/tensorflow/lite/micro/kernels/gather_nd.cc#L143-L154Third Party Advisory
https://github.com/tensorflow/tflite-micro/commit/4142e47e9e31db481781b955ed3ff807a781b494Patch, Third Party Advisory

Timeline

Published: Sep 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-359399.8TensorFlow is an open source platform for machine learning. The `ScatterNd` function takes an input argument that determines the indices of CVE-2022-35945.3A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback CVE-2022-359407.5TensorFlow is an open source platform for machine learning. The `RaggedRangOp` function takes an argument `limits` that is eventually used t CVE-2022-359417.5TensorFlow is an open source platform for machine learning. The `AvgPoolOp` function takes an argument `ksize` that must be positive but is CVE-2022-3594210.0Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contai CVE-2022-359438.8Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitak CVE-2022-359447.2October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects instal CVE-2022-359456.1GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service D CVE-2022-359466.5GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service D CVE-2022-359479.8GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service D CVE-2022-359485.3undici is an HTTP/1.1 client, written from scratch for Node.js.`=< undici@5.8.0` users are vulnerable to _CRLF Injection_ on headers when us CVE-2022-359499.8undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an applicat