CVE-2022-23561

Advisory

Tensorflow-gpu versions 2.5.3, 2.6.3, 2.7.1 and 2.8.0 include a fix for CVE-2022-23561: An attacker can craft a TFLite model that would cause a write outside of bounds of an array in TFLite. In fact, the attacker can override the linked list used by the memory allocator. This can be leveraged for an arbitrary write primitive under certain conditions.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9c78-vcq7-7vxq

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23561
• https://github.com/tensorflow/tensorflow/commit/6c0b2b70eeee588591680f5b7d5d38175fd7cdf6
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9c78-vcq7-7vxq