What is the severity of CVE-2022-23594?

CVE-2022-23594 has a medium severity level due to the potential for denial of service attacks through specific input modifications.

How do I fix CVE-2022-23594?

To fix CVE-2022-23594, upgrade TensorFlow to version 2.7.1 or later where the issue has been addressed.

What versions of TensorFlow are affected by CVE-2022-23594?

CVE-2022-23594 affects TensorFlow version 2.7.0.

What type of vulnerability is CVE-2022-23594?

CVE-2022-23594 is categorized as a security vulnerability that can lead to application instability or denial of service.

Who is impacted by CVE-2022-23594?

Users and developers utilizing TensorFlow version 2.7.0 are impacted by CVE-2022-23594.

Vulnerability/
CVE-2022-23594

high

8.8

CWE

125 787

4/2/2022

3/8/2024

CVE-2022-23594: Out of bounds read in Tensorflow

First published: Fri Feb 04 2022(Updated: )

Tensorflow is an Open Source Machine Learning Framework. The TFG dialect of TensorFlow (MLIR) makes several assumptions about the incoming `GraphDef` before converting it to the MLIR-based dialect. If an attacker changes the `SavedModel` format on disk to invalidate these assumptions and the `GraphDef` is then converted to MLIR-based IR then they can cause a crash in the Python interpreter. Under certain scenarios, heap OOB read/writes are possible. These issues have been discovered via fuzzing and it is possible that more weaknesses exist. We will patch them as they are discovered.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Google TensorFlow	=2.7.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2022-23594?
CVE-2022-23594 has a medium severity level due to the potential for denial of service attacks through specific input modifications.
How do I fix CVE-2022-23594?
To fix CVE-2022-23594, upgrade TensorFlow to version 2.7.1 or later where the issue has been addressed.
What versions of TensorFlow are affected by CVE-2022-23594?
CVE-2022-23594 affects TensorFlow version 2.7.0.
What type of vulnerability is CVE-2022-23594?
CVE-2022-23594 is categorized as a security vulnerability that can lead to application instability or denial of service.
Who is impacted by CVE-2022-23594?
Users and developers utilizing TensorFlow version 2.7.0 are impacted by CVE-2022-23594.

collector/nvd-index
agent/references
agent/weakness
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/author
agent/last-modified-date
agent/title
agent/severity
agent/description
agent/first-publish-date
agent/event
agent/tags
agent/source
vendor/google
canonical/google tensorflow
version/google tensorflow/2.7.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2022-23594?
CVE-2022-23594 has a medium severity level due to the potential for denial of service attacks through specific input modifications.
How do I fix CVE-2022-23594?
To fix CVE-2022-23594, upgrade TensorFlow to version 2.7.1 or later where the issue has been addressed.
What versions of TensorFlow are affected by CVE-2022-23594?
CVE-2022-23594 affects TensorFlow version 2.7.0.
What type of vulnerability is CVE-2022-23594?
CVE-2022-23594 is categorized as a security vulnerability that can lead to application instability or denial of service.
Who is impacted by CVE-2022-23594?
Users and developers utilizing TensorFlow version 2.7.0 are impacted by CVE-2022-23594.