CVE-2022-23588

published 2022-02-04

CVE-2022-23588: Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that Grappler optimizer…

Priority P4 30 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C N I N A H

Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that Grappler optimizer would attempt to build a tensor using a reference `dtype`. This would result in a crash due to a `CHECK`-fail in the `Tensor` constructor as reference types are not allowed. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
debian	tensorflow	—	—
google	tensorflow	<= 2.5.2	—
google	tensorflow	—	—
google	tensorflow	2.6.0 – 2.6.2	—
intel	optimization_for_tensorflow	>= 0 < 2.5.3	2.5.3
intel	optimization_for_tensorflow	>= 2.6.0 < 2.6.3	2.6.3
intel	optimization_for_tensorflow	>= 2.7.0 < 2.7.1	2.7.1
tensorflow	tensorflow	< 2.5.3	2.5.3
tensorflow	tensorflow	—	—
tensorflow	tensorflow	—	—

CVSS provenance

nvd v3.1 6.5 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:N/I:N/A:P

vendor_debian 6.5 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-617