CVE-2022-23580

Advisory

Tensorflow versions 2.5.3, 2.6.3, 2.7.1 and 2.8.0 include a fix for CVE-2022-23580: During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-627q-g293-49q7

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Tensorflow is an Open Source Machine Learning Framework. During shape inference, TensorFlow can allocate a large vector based on a value from a tensor controlled by the user. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. See CVE-2022-23580.


CONFIRM:https://github.com/tensorflow/tensorflow/security/advisories/GHSA-627q-g293-49q7: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-627q-g293-49q7
MISC:https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L788-L790: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L788-L790
MISC:https://github.com/tensorflow/tensorflow/commit/1361fb7e29449629e1df94d44e0427ebec8c83c7: https://github.com/tensorflow/tensorflow/commit/1361fb7e29449629e1df94d44e0427ebec8c83c7

Resources

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-627q-g293-49q7
• https://github.com/tensorflow/tensorflow/commit/1361fb7e29449629e1df94d44e0427ebec8c83c7
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23580
• https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L788-L790