CVE-2022-23590

Advisory

Tensorflow-gpu versions 2.7.1 and 2.8.0 include a fix for CVE-2022-23590: A 'GraphDef' from a TensorFlow 'SavedModel' can be maliciously altered to cause a TensorFlow process to crash due to encountering a 'StatusOr' value that is an error and forcibly extracting the value from it.
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pqrv-8r2f-7278

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23590
• https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/core/graph/graph.cc#L560-L567
• https://github.com/tensorflow/tensorflow/commit/955059813cc325dc1db5e2daa6221271406d4439
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-pqrv-8r2f-7278