Google · Tensorflow · CVE-2022-36012
**Name of the Vulnerable Software and Affected Versions**
TensorFlow versions prior to 2.10.0
TensorFlow versions 2.9.1 and earlier
TensorFlow versions 2.8.1 and earlier
TensorFlow versions 2.7.2 and earlier
**Description**
The issue occurs when `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, causing it to crash. The crash happens because `ret val.second` and `input` cannot be empty. There are no known workarounds for this issue.
**Recommendations**
For TensorFlow versions prior to 2.10.0, update to TensorFlow 2.10.0 or later.
For TensorFlow versions 2.9.1 and earlier, update to TensorFlow 2.9.1 or later.
For TensorFlow versions 2.8.1 and earlier, update to TensorFlow 2.8.1 or later.
For TensorFlow versions 2.7.2 and earlier, update to TensorFlow 2.7.2 or later.
As a temporary workaround, consider disabling the `mlir::tfg::ConvertGenericFunctionToFunctionDef` function until a patch is available.