CVE-2022-41902: 
Python vulnerability analysis and mitigation

TensorFlow, an open source platform for machine learning, disclosed a vulnerability (CVE-2022-41902) in the MakeGrapplerFunctionItem function. The vulnerability was discovered in versions prior to 2.11.0 and was patched in versions 2.8.4, 2.9.3, 2.10.1, and 2.11.0. The issue was identified through internal fuzzing and disclosed on December 6, 2022 (GitHub Advisory, NVD).

The vulnerability exists in the MakeGrapplerFunctionItem function, which handles arguments determining the sizes of inputs and outputs. When the inputs given are greater than or equal to the sizes of the outputs, it triggers an out-of-bounds memory read or causes a crash. The issue was assigned a CVSS v3.1 score of 9.1 (CRITICAL) (NVD).

The vulnerability can lead to out-of-bounds memory read or system crashes, potentially allowing attackers to cause denial of service or potentially access unauthorized memory regions (GitHub Advisory).

The issue has been patched in GitHub commit a65411a1d69edfb16b25907ffb8f73556ce36bb7 and included in TensorFlow versions 2.11.0, 2.10.1, 2.9.3, and 2.8.4. Users are advised to upgrade to these patched versions to mitigate the vulnerability (GitHub Advisory).