CVE-2022-23594: Out of bounds read in Tensorflow
Tensorflow is an Open Source Machine Learning Framework. The TFG dialect of TensorFlow (MLIR) makes several assumptions about the incoming GraphDef before converting it to the MLIR-based dialect. If an attacker changes the SavedModel format on disk to invalidate these assumptions and the GraphDef is then converted to MLIR-based IR then they can cause a crash in the Python interpreter. Under certain scenarios, heap OOB read/writes are possible. These issues have been discovered via fuzzing and it is possible that more weaknesses exist. We will patch them as they are discovered.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-23594?
CVE-2022-23594 has a medium severity level due to the potential for denial of service attacks through specific input modifications.
How do I fix CVE-2022-23594?
To fix CVE-2022-23594, upgrade TensorFlow to version 2.7.1 or later where the issue has been addressed.
What versions of TensorFlow are affected by CVE-2022-23594?
CVE-2022-23594 affects TensorFlow version 2.7.0.
What type of vulnerability is CVE-2022-23594?
CVE-2022-23594 is categorized as a security vulnerability that can lead to application instability or denial of service.
Who is impacted by CVE-2022-23594?
Users and developers utilizing TensorFlow version 2.7.0 are impacted by CVE-2022-23594.