CVE-2022-23590

Description

Tensorflow is an Open Source Machine Learning Framework. A GraphDef from a TensorFlow SavedModel can be maliciously altered to cause a TensorFlow process to crash due to encountering a StatusOr value that is an error and forcibly extracting the value from it. We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.

Risk Information

Base Score

7.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.239

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities are fixed in Python-tensorflow 2.7.1	Windows
Multiple vulnerabilities are fixed in Python-tensorflow-cpu 2.7.1	Windows
Multiple vulnerabilities are fixed in Python-tensorflow-gpu 2.7.1	Windows
Multiple vulnerabilities are fixed in Python-tensorflow for linux 2.7.1	Linux
Multiple vulnerabilities are fixed in Python-tensorflow-cpu for linux 2.7.1	Linux
Multiple vulnerabilities are fixed in Python-tensorflow-gpu for linux 2.7.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234