CVE-2022-23577

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1, 2.6.3, and 2.5.3 are also affected

Description The implementation of GetInitOp is vulnerable to a crash caused by dereferencing a null pointer. This issue can be exploited by a malicious user altering the SavedModel protobuf format on disk before loading, causing the second .find to return nullptr.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For version 2.7.1, update to a version that includes the cherrypicked commit. For version 2.6.3, update to a version that includes the cherrypicked commit. For version 2.5.3, update to a version that includes the cherrypicked commit. As a temporary workaround, consider restricting access to the GetInitOp implementation until a patch is available.