CVE-2022-23559
Fixed upstream EPSS 1%CVSS 8.8
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication. In certain scenarios, this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.
Products: tensorflow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | tensorflow | 2.6.3 |
| PyPI | tensorflow | 2.7.1 |
| PyPI | tensorflow | 2.5.3 |
| PyPI | tensorflow-cpu | a4e401da71458d253b05e41f28637b65baf64be4 |
| PyPI | tensorflow-cpu | 2.5.3 |
| PyPI | tensorflow-cpu | 2.6.3 |
| PyPI | tensorflow-cpu | 2.7.1 |
| PyPI | tensorflow-cpu | f19be71717c497723ba0cea0379e84f061a75e01 |
| PyPI | tensorflow-cpu | 1de49725a5fc4e48f1a3b902ec3599ee99283043 |
| PyPI | tensorflow-gpu | 2.5.3 |
| PyPI | tensorflow-gpu | 1de49725a5fc4e48f1a3b902ec3599ee99283043 |
| PyPI | tensorflow-gpu | f19be71717c497723ba0cea0379e84f061a75e01 |
| PyPI | tensorflow-gpu | a4e401da71458d253b05e41f28637b65baf64be4 |
| PyPI | tensorflow-gpu | 2.7.1 |
| PyPI | tensorflow-gpu | 2.6.3 |