PyPI: tensorflow-macos
CVE-2022-23579
Safety vulnerability ID: SFTY-20220204-51966
Safety legacy ID: pyup.io-58432
Tensorflow-macos versions 2.5.3, 2.6.3, 2.7.1 and 2.8.0 include a fix for CVE-2022-23579: The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a 'SavedModel' such that 'SafeToRemoveIdentity' would trigger 'CHECK' failures. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5f2r-qp73-37mr
Overview
`CHECK`-failures during Grappler's `SafeToRemoveIdentity` in Tensorflow
Advisory
Tensorflow-macos versions 2.5.3, 2.6.3, 2.7.1 and 2.8.0 include a fix for CVE-2022-23579: The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a 'SavedModel' such that 'SafeToRemoveIdentity' would trigger 'CHECK' failures. https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5f2r-qp73-37mr
Affected Package
Also affects
---
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20220204-51966/CVE-2022-23579
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5f2r-qp73-37mr
- https://github.com/tensorflow/tensorflow/commit/92dba16749fae36c246bec3f9ba474d9ddeb7662
- https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/optimizers/dependency_optimizer.cc#L59-L98
- https://nvd.nist.gov/vuln/detail/CVE-2022-23579
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-88.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-143.yaml
- https://github.com/advisories/GHSA-5f2r-qp73-37mr
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more