VYPR
High severityNVD Advisory· Published Feb 4, 2022· Updated Apr 22, 2025

Out of bounds read in Tensorflow

CVE-2022-23592

Description

Tensorflow is an Open Source Machine Learning Framework. TensorFlow's type inference can cause a heap out of bounds read as the bounds checking is done in a DCHECK (which is a no-op during production). An attacker can control the input_idx variable such that ix would be larger than the number of values in node_t.args. The fix will be included in TensorFlow 2.8.0. This is the only affected version.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
>= 2.8.0-rc0, < 2.8.02.8.0
tensorflow-cpuPyPI
>= 2.8.0-rc0, < 2.8.02.8.0
tensorflow-gpuPyPI
>= 2.8.0-rc0, < 2.8.02.8.0

Affected products

1

Patches

1
c99d98cd1898

Handle invalid inputs instead of crashing.

https://github.com/tensorflow/tensorflowDan MoldovanNov 13, 2021via ghsa
1 file changed · +10 4
  • tensorflow/core/graph/graph.cc+10 4 modified
    @@ -222,10 +222,16 @@ void Node::RunForwardTypeInference() {
           const auto& node_t = node->def().experimental_type();
           if (node_t.type_id() != TFT_UNSET) {
             int ix = input_idx[i];
    -        DCHECK(ix < node_t.args_size())
    -            << "input " << i << " should have an output " << ix
    -            << " but instead only has " << node_t.args_size()
    -            << " outputs: " << node_t.DebugString();
    +        if (ix >= node_t.args_size()) {
    +          LOG(WARNING) << name() << " has bad type information: input " << i
    +                       << " should have an output " << ix
    +                       << " but instead only has " << node_t.args_size()
    +                       << " outputs: " << node_t.DebugString()
    +                       << "\nThis indicates either "
    +                          "a bug in op registration or a corrupted graph.";
    +          ClearTypeInfo();
    +          return;
    +        }
             input_types.emplace_back(node_t.args(ix));
           } else {
             input_types.emplace_back(*no_type);
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.