CVE-2022-23562
HIGHTensorFlow < 2.5.3 - Integer Overflow in Range Implementation
Title source: llmDescription
Tensorflow is an Open Source Machine Learning Framework. The implementation of `Range` suffers from integer overflows. These can trigger undefined behavior or, in some scenarios, extremely large allocations. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
References (4)
Core 4
Core References
Third Party Advisory x_refsource_misc
https://github.com/tensorflow/tensorflow/pull/51733
Patch, Third Party Advisory x_refsource_confirm
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qx3f-p745-w4hr
Third Party Advisory x_refsource_misc
https://github.com/tensorflow/tensorflow/issues/52676
Patch, Third Party Advisory x_refsource_misc
https://github.com/tensorflow/tensorflow/commit/f0147751fd5d2ff23251149ebad9af9f03010732
Scores
CVSS v3
7.6
EPSS
0.0057
EPSS Percentile
42.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-190
Status
published
Products (5)
google/tensorflow
2.7.0
google/tensorflow
< 2.5.2
pypi/tensorflow
0 - 2.5.3PyPI
pypi/tensorflow-cpu
0 - 2.5.3PyPI
pypi/tensorflow-gpu
0 - 2.5.3PyPI
Published
Feb 04, 2022
Tracked Since
Feb 18, 2026