CVE-2022-23565

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1, 2.6.3, and 2.5.3 are also affected

Description An attacker can trigger denial of service via assertion failure by altering a SavedModel on disk such that AttrDefs of some operation are duplicated.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.1, 2.6.3, and 2.5.3, update to the respective cherrypicked versions. As a temporary workaround, consider restricting access to SavedModel files to minimize the risk of exploitation.