CVE-2022-23560

Name of the Vulnerable Software and Affected Versions TensorFlow versions 2.5.3 through 2.7.1 TensorFlow version 2.8.0 is not affected, as it includes the fix.

Description An attacker can craft a TFLite model that would allow limited reads and writes outside of arrays in TFLite. This exploits missing validation in the conversion from sparse tensors to dense tensors.

Recommendations For TensorFlow versions 2.5.3, 2.6.3, and 2.7.1, upgrade to the respective patched versions as soon as possible. For TensorFlow versions prior to 2.8.0, upgrade to version 2.8.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of TFLite models until a patch is applied.