CVE-2022-23586Medium· 6.5▾ SunlitMultiple `CHECK`-fails in `function.cc` in TensowFlow
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.8%
0.8% → 0.8%
A malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter.
We have patched the issue in GitHub commits dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2 and 3d89911481ba6ebe8c88c1c0b595412121e6c645.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
tensorflow < 2.5.3tensorflow >= 2.6.0, < 2.6.3tensorflow >= 2.7.0, < 2.7.1tensorflow-cpu < 2.5.3tensorflow-cpu >= 2.6.0, < 2.6.3tensorflow-cpu >= 2.7.0, < 2.7.1tensorflow-gpu < 2.5.3tensorflow-gpu >= 2.6.0, < 2.6.3tensorflow-gpu >= 2.7.0, < 2.7.1Upgrade to a patched release:
tensorflow 2.5.3tensorflow 2.6.3tensorflow 2.7.1tensorflow-cpu 2.5.3tensorflow-cpu 2.6.3tensorflow-cpu 2.7.1tensorflow-gpu 2.5.3tensorflow-gpu 2.6.3tensorflow-gpu 2.7.1Connected by shared product, vendor, weakness, or advisory.
CVE-2021-29541Low· 2.5Null pointer dereference in `StringNGrams`
CVE-2021-29525Low· 2.5Division by 0 in `Conv2DBackpropInput`
CVE-2021-29527Low· 2.5Division by 0 in `QuantizedConv2D`
CVE-2021-29524Low· 2.5Division by 0 in `Conv2DBackpropFilter`
CVE-2020-15207High· 8.7Segfault and data corruption in tensorflow-lite
CVE-2021-29535Low· 2.5Heap buffer overflow in `QuantizedMul`