Skip to content
OtherMedium

CVE-2022-23567: Tensorflow is an Open Source Machine Learning Framework. The implementations of `Sparse*Cwise*` ops …

Occurred
Feb 3, 2022
Published
Feb 3, 2022
Source
NVD CVE

Summary

Tensorflow is an Open Source Machine Learning Framework. The implementations of `Sparse*Cwise*` ops are vulnerable to integer overflows. These can be used to trigger large allocations (so, OOM based denial of service) or `CHECK`-fails when building new `TensorShape` objects (so, assert failures based denial of service). We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-provided dimensions. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Tags

  • CVE
  • CVE-2022-23567
  • cvss:MEDIUM

Classification

Category confidence: 90%
Severity confidence: 85%

Rationale: CVE describes a software vulnerability in TensorFlow causing denial of service, not an AI safety incident.

Classifier: Qwen/Qwen3.5-35B-A3B-FP8

Visit source