CVE-2022-23593

TensorFlow CVE-2022-23593 affects the MLIR-TFRT simplifyBroadcast path. When shapes are scalar, maxRank becomes 0 and an empty SmallVector is built, leading to a segfault (denial of service). The fix is planned for TensorFlow 2.8.0; upgrading to that version (or newer) is the remediation if appli...

CVE-2022-23593 Segfault in `simplifyBroadcast` in Tensorflow

Tensorflow is an Open Source Machine Learning Framework. The simplifyBroadcast function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault hence, denial of service, if called with scalar shapes. If all shapes are scalar, then maxRank is 0, so we build an empty SmallVector...