VYPR
← All advisories
High severityNVD Advisory· Published Feb 4, 2022· Updated Apr 22, 2025

Out of bounds read and write in Tensorflow

CVE-2022-23574

Description

Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's SpecializeType which results in heap OOB read/write. Due to a typo, arg is initialized to the ith mutable argument in a loop where the loop index is j. Hence it is possible to assign to arg from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.5.32.5.3
tensorflowPyPI
>= 2.6.0, < 2.6.32.6.3
tensorflowPyPI
>= 2.7.0, < 2.7.12.7.1
tensorflow-cpuPyPI
< 2.5.32.5.3
tensorflow-cpuPyPI
>= 2.6.0, < 2.6.32.6.3
tensorflow-cpuPyPI
>= 2.7.0, < 2.7.12.7.1
tensorflow-gpuPyPI
< 2.5.32.5.3
tensorflow-gpuPyPI
>= 2.6.0, < 2.6.32.6.3
tensorflow-gpuPyPI
>= 2.7.0, < 2.7.12.7.1

Affected products

1

Patches

1
0657c83d0884

Fix heap OOB read/write due to incorrect indexing.

https://github.com/tensorflow/tensorflowMihai MaruseacNov 9, 2021via ghsa
commit
1 file changed · +1 −1
  • tensorflow/core/framework/full_type_util.cc+1 −1 modified
    @@ -100,7 +100,7 @@ StatusOr<FullTypeDef> SpecializeType(const AttrSlice& attrs,
     // verifications are needed, they should be done by separately, and in a
     // way that can be reused for type inference.
     for (int j = 0; j < t->args_size(); j++) {
-      auto* arg = t->mutable_args(i);
+      auto* arg = t->mutable_args(j);
       if (arg->type_id() == TFT_VAR) {
         const auto* attr = attrs.Find(arg->s());
         if (attr == nullptr) {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.