CVE-2022-23578 | Vulnetix

CVE-2022-23578 PUBLISHED CVSS 4.300000190734863 MEDIUM

Tensorflow is an Open Source Machine Learning Framework. If a graph node is invalid, TensorFlow can leak memory in the implementation of `ImmutableExecutorState::Initialize`. Here, we set `item->kernel` to `nullptr` but it is a simple `OpKernel*` pointer so the memory that was previously allocated to it would leak. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

EPSS 0.72% · 52.0th percentile

Risk Scores

CVSS 3.1

4.300000190734863

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS Score

0.72%

52.0th percentile

Affected Products

Vendor	Product	Versions
Bitnami	tensorflow	2.7.0, 0, 2.6.0
Bitnami	tensorflow	0, 2.6.0, 2.7.0

Timeline

Feb 4, 2022 CVE Published
Feb 8, 2022 EPSS Score
Apr 2, 2022 EPSS Score
May 25, 2022 EPSS Score
Jul 17, 2022 EPSS Score
Sep 8, 2022 EPSS Score
Oct 31, 2022 EPSS Score
Dec 23, 2022 EPSS Score
Feb 14, 2023 EPSS Score
Apr 7, 2023 EPSS Score
May 30, 2023 EPSS Score
Jul 22, 2023 EPSS Score

References

Open in Interactive Console →