Tensorflow — Dos (CVE-2022-23581)
Date: 2022-02
Affected: google/tensorflow
Attack vector: dos
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2022-23581
CVE-2022-23588
CVE-2022-23589
CWE: CWE-476
CWE-617
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)

Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `IsSimplifiableReshape` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.


Mitigations:

Architectural layers (MAESTRO):