CVE-2022-23578 — Missing Release of Memory after Effective Lifetime in Tensorflow
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 57.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 4
Latest updateFeb 10
Description
Tensorflow is an Open Source Machine Learning Framework. If a graph node is invalid, TensorFlow can leak memory in the implementation of `ImmutableExecutorState::Initialize`. Here, we set `item->kernel` to `nullptr` but it is a simple `OpKernel*` pointer so the memory that was previously allocated to it would leak. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in …
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4
Affected Packages3 packages
Patches
🔴Vulnerability Details
4📋Vendor Advisories
1Debian▶
CVE-2022-23578: tensorflow - Tensorflow is an Open Source Machine Learning Framework. If a graph node is inva...↗2022