Vulnerability Details : CVE-2022-23577
Potential exploit
Tensorflow is an Open Source Machine Learning Framework. The implementation of `GetInitOp` is vulnerable to a crash caused by dereferencing a null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Products affected by CVE-2022-23577
- cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
- cpe:2.3:a:google:tensorflow:2.7.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-23577
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 51 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-23577
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:P |
8.0
|
2.9
|
NIST | |
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
NIST | |
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
2.8
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2022-23577
-
The product dereferences a pointer that it expects to be valid but is NULL.Assigned by: security-advisories@github.com (Primary)
References for CVE-2022-23577
-
https://github.com/tensorflow/tensorflow/commit/4f38b1ac8e42727e18a2f0bde06d3bee8e77b250
Prevent null dereference read in `GetInitOp`. · tensorflow/tensorflow@4f38b1a · GitHubPatch;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/cc/saved_model/loader_util.cc#L31-L61
tensorflow/loader_util.cc at a1320ec1eac186da1d03f033109191f715b2b130 · tensorflow/tensorflow · GitHubExploit;Third Party Advisory
-
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8cxv-76p7-jxwr
Null dereference in `GetInitOp` · Advisory · tensorflow/tensorflow · GitHubPatch;Third Party Advisory
Jump to