Dan Moldovan

3 exploits Active since Feb 2022
CVE-2022-23590 WRITEUP MEDIUM WRITEUP
TensorFlow < 2.7.1 - Denial of Service via Malicious GraphDef in SavedModel
Tensorflow is an Open Source Machine Learning Framework. A `GraphDef` from a TensorFlow `SavedModel` can be maliciously altered to cause a TensorFlow process to crash due to encountering a `StatusOr` value that is an error and forcibly extracting the value from it. We have patched the issue in multiple GitHub commits and these will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1, as both are affected.
CVSS 5.9
CVE-2022-23592 WRITEUP HIGH WRITEUP
TensorFlow 2.7.0-2.8.0 - Heap Out-of-Bounds Read via Type Inference
Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a `DCHECK` (which is a no-op during production). An attacker can control the `input_idx` variable such that `ix` would be larger than the number of values in `node_t.args`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.
CVSS 8.1
CVE-2022-36016 WRITEUP MEDIUM WRITEUP
TensorFlow < 2.7.2 - Reachable Assertion in FullTypeDef Substitution
TensorFlow is an open source platform for machine learning. When `tensorflow::full_type::SubstituteFromAttrs` receives a `FullTypeDef& t` that is not exactly three args, it triggers a `CHECK`-fail instead of returning a status. We have patched the issue in GitHub commit 6104f0d4091c260ce9352f9155f7e9b725eab012. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
CVSS 5.9