CVE-2022-23578

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier TensorFlow versions 2.5.3 and earlier

Description The issue arises when a graph node is invalid, causing TensorFlow to leak memory in the implementation of ImmutableExecutorState::Initialize. This occurs because item->kernel is set to nullptr, but it is a simple OpKernel* pointer, resulting in a memory leak of previously allocated memory.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later to resolve the issue. For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later to resolve the issue. For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later to resolve the issue. For versions 2.5.3 and earlier, update to TensorFlow 2.5.3 or later to resolve the issue.