CVE-2022-23566

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.0 through 2.7.1 TensorFlow versions 2.6.0 through 2.6.3 TensorFlow versions 2.5.0 through 2.5.3

Description TensorFlow is vulnerable to a heap out-of-bounds (OOB) write in Grappler. The set output function writes to an array at the specified index, giving a malicious user a write primitive.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.0 through 2.7.1, update to TensorFlow 2.7.1. For versions 2.6.0 through 2.6.3, update to TensorFlow 2.6.3. For versions 2.5.0 through 2.5.3, update to TensorFlow 2.5.3.