CVE-2022-23569
Last modified
CVE-2022-23569 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Tensorflow is an Open Source Machine Learning Framework. Multiple operations in TensorFlow can be used to trigger a denial of service via `CHECK`-fails (i.e., assertion failures). EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
Tensorflow is an Open Source Machine Learning Framework. Multiple operations in TensorFlow can be used to trigger a denial of service via `CHECK`-fails (i.e., assertion failures). This is similar to TFSA-2021-198 and has similar fixes. We have patched the reported issues in multiple GitHub commits. It is possible that other similar instances exist in TensorFlow, we will issue fixes as these are discovered. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Tensorflow | <= 2.5.2 | |
| Tensorflow | >= 2.6.0, <= 2.6.2 | |
| Tensorflow | 2.7.0 |
References
- https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.mdPatch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qj5r-f9mv-rffhPatch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.mdPatch, Third Party Advisory
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qj5r-f9mv-rffhPatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-23569?
How severe is CVE-2022-23569?
How do I fix CVE-2022-23569?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-23563Tensorflow is an Open Source Machine Learning Framework. In …6.3
- CVE-2022-23564Tensorflow is an Open Source Machine Learning Framework. Whe…6.5
- CVE-2022-23565Tensorflow is an Open Source Machine Learning Framework. An …6.5
- CVE-2022-23566Tensorflow is an Open Source Machine Learning Framework. Ten…8.8
- CVE-2022-23567Tensorflow is an Open Source Machine Learning Framework. The…6.5
- CVE-2022-23568Tensorflow is an Open Source Machine Learning Framework. The…6.5
- CVE-2022-2357The WSM Downloader WordPress plugin through 1.4.0 allows any…7.5
- CVE-2022-23570Tensorflow is an Open Source Machine Learning Framework. Whe…6.5
- CVE-2022-23571Tensorflow is an Open Source Machine Learning Framework. Whe…6.5
- CVE-2022-23572Tensorflow is an Open Source Machine Learning Framework. Und…6.5
- CVE-2022-23573Tensorflow is an Open Source Machine Learning Framework. The…8.8
- CVE-2022-23574Tensorflow is an Open Source Machine Learning Framework. The…8.8
Are you affected by CVE-2022-23569?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
