id: PYSEC-2022-84
details: Tensorflow is an Open Source Machine Learning Framework. The implementation
  of `OpLevelCostEstimator::CalculateTensorSize` is vulnerable to an integer overflow
  if an attacker can create an operation which would involve a tensor with large enough
  number of elements. The fix will be included in TensorFlow 2.8.0. We will also cherrypick
  this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these
  are also affected and still in supported range.
affected:
- package:
    name: tensorflow-cpu
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow-cpu
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: fcd18ce3101f245b083b30655c27b239dc72221e
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.5.3
    - introduced: 2.6.0
    - fixed: 2.6.3
  versions:
  - 1.15.0
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.6.0
  - 2.6.1
  - 2.6.2
references:
- type: WEB
  url: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L1552-L1558
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/fcd18ce3101f245b083b30655c27b239dc72221e
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-c94w-c95p-phf8
aliases:
- CVE-2022-23575
- GHSA-c94w-c95p-phf8
modified: "2022-03-09T00:17:34.290009Z"
published: "2022-02-04T23:15:00Z"