id: PYSEC-2022-130
details: Tensorflow is an Open Source Machine Learning Framework. TensorFlow is vulnerable
  to a heap OOB write in `Grappler`. The `set_output` function writes to an array
  at the specified index. Hence, this gives a malicious user a write primitive. The
  fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on
  TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected
  and still in supported range.
affected:
- package:
    name: tensorflow-gpu
    ecosystem: PyPI
    purl: pkg:pypi/tensorflow-gpu
  ranges:
  - type: GIT
    repo: https://github.com/tensorflow/tensorflow
    events:
    - introduced: "0"
    - fixed: 97282c6d0d34476b6ba033f961590b783fa184cd
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.5.3
    - introduced: 2.6.0
    - fixed: 2.6.3
  versions:
  - 0.12.0
  - 0.12.1
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.10.0
  - 1.10.1
  - 1.11.0
  - 1.12.0
  - 1.12.2
  - 1.12.3
  - 1.13.1
  - 1.13.2
  - 1.14.0
  - 1.15.0
  - 1.15.2
  - 1.15.3
  - 1.15.4
  - 1.15.5
  - 1.2.0
  - 1.2.1
  - 1.3.0
  - 1.4.0
  - 1.4.1
  - 1.5.0
  - 1.5.1
  - 1.6.0
  - 1.7.0
  - 1.7.1
  - 1.8.0
  - 1.9.0
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.1.0
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.1.4
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.5.0
  - 2.5.1
  - 2.5.2
  - 2.6.0
  - 2.6.1
  - 2.6.2
references:
- type: ADVISORY
  url: https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5qw5-89mw-wcg2
- type: WEB
  url: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.h#L394
- type: FIX
  url: https://github.com/tensorflow/tensorflow/commit/97282c6d0d34476b6ba033f961590b783fa184cd
- type: WEB
  url: https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/graph_properties.cc#L1132-L1141
aliases:
- CVE-2022-23566
- GHSA-5qw5-89mw-wcg2
modified: "2022-03-09T00:18:26.438942Z"
published: "2022-02-04T23:15:00Z"