CVE-2022-41900: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, disclosed a vulnerability (CVE-2022-41900) that was reported through the OSS VRP program and published on November 18, 2022. The vulnerability affects TensorFlow versions prior to 2.11.0, with patched versions including 2.8.4, 2.9.3, 2.10.1, and 2.11.0 (GitHub Advisory).

The vulnerability occurs when an input poolingratio parameter that is smaller than 1 is provided to tf.rawops.FractionalMaxPool and tf.raw_ops.FractionalAvgPool functions, which can trigger a heap out-of-bounds (OOB) buffer access. The issue was assigned a CVSS v3.1 score of 7.5 (High severity) (NVD).

When successfully exploited, this vulnerability could lead to heap buffer overflow conditions, potentially resulting in program crashes or arbitrary code execution in applications using the affected TensorFlow functions (GitHub Advisory).

The vulnerability has been patched in GitHub commit 216525144ee7c910296f5b05d214ca1327c9ce48. Users are advised to upgrade to TensorFlow versions 2.8.4, 2.9.3, 2.10.1, or 2.11.0 which contain the security fix. The patch implements proper validation of the pooling_ratio parameter to ensure it cannot be smaller than 1 (GitHub Commit).