CVE-2022-23586: Multiple `CHECK`-fails in `function.cc` in TensowFlow
(updated )
A malicious user can cause a denial of service by altering a SavedModel such that assertions in function.cc would be falsified and crash the Python interpreter.
References
- github.com/advisories/GHSA-43jf-985q-588j
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-95.yaml
- github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-150.yaml
- github.com/tensorflow/tensorflow
- github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/function.cc
- github.com/tensorflow/tensorflow/commit/3d89911481ba6ebe8c88c1c0b595412121e6c645
- github.com/tensorflow/tensorflow/commit/dcc21c7bc972b10b6fb95c2fb0f4ab5a59680ec2
- github.com/tensorflow/tensorflow/security/advisories/GHSA-43jf-985q-588j
- nvd.nist.gov/vuln/detail/CVE-2022-23586
Code Behaviors & Features
Detect and mitigate CVE-2022-23586 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →