Vulnerability in Google Tensorflow
CVE-2022-23593
Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0, so we build an empty `SmallVector`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.009 (57.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 57th percentile — 57.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Google Tensorflow
- Tensorflow — versions >= 2.7.0, < 2.8.0
Weakness classification (CWE)
References
- github.com/tensorflow/tensorflow/security/advisories/GHSA-gwcx-jrx4-92w2 (Patch, Third Party Advisory)
- github.com/tensorflow/tensorflow/commit/35f0fabb4c178253a964d7aabdbb15c6a398b69a (Patch, Third Party Advisory)
- github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/… (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-23593?
- CVE-2022-23593 is a medium-severity vulnerability in Google Tensorflow, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 5.9/10. Published 2022-02-04.
- How severe is CVE-2022-23593?
- Medium severity. CVSS v3 base score is 5.9 out of 10.