Lucene search

[email protected]NVD:CVE-2022-23581

HistoryFeb 04, 2022 - 11:15 p.m.

CVE-2022-23581

2022-02-0423:15:14

CWE-617

[email protected]

web.nvd.nist.gov

tensorflow

grappler optimizer

vulnerability

denial of service

savedmodel

issimplifiablereshape

check failures

fix

tensorflow 2.8.0

cherrypick

commit

supported range

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

65.0%

JSON

Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that IsSimplifiableReshape would trigger CHECK failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Affected configurations

Nvd

Node

googletensorflowRange≤2.5.2

googletensorflowRange2.6.0–2.6.2

googletensorflowMatch2.7.0

VendorProductVersionCPE
googletensorflow*cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
googletensorflow2.7.0cpe:2.3:a:google:tensorflow:2.7.0:*:*:*:*:*:*:*