CVE-2022-23579

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-23579

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-23579.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2022-23579

Aliases

Downstream

openSUSE-SU-2024:12116-1

Related

openSUSE-SU-2024:12116-1

Published

2022-02-04T22:32:26Z

Modified

2026-04-16T03:48:37.845649Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

`CHECK`-failures during Grappler's `SafeToRemoveIdentity` in Tensorflow

Details

Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a SavedModel such that SafeToRemoveIdentity would trigger CHECK failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Database specific

{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-617"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23579.json"
}

References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type: GIT
Repo: https://github.com/tensorflow/tensorflow
Events: Introduced

919f693420e35d00c8d0a42100837ae3718f7927

Fixed

959e9b2a0c06df945f9fb66bd367af8832ca0d28

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-23579.json"