CVE-2022-23559: high-severity vulnerability in tensorflow
Integer overflow in TFLite
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A specially crafted machine learning model can cause an integer overflow in TensorFlow Lite's embedding lookup operations, potentially leading to unauthorized memory access. This vulnerability allows attackers to read or write data outside the intended heap memory boundaries.
Integer overflow in embedding_size and lookup_size calculations within TFLite's embedding lookup operations results from insufficient input validation on user-supplied parameters. Exploitation requires crafting a malicious TFLite model; successful overflow can lead to heap out-of-bounds read/write, enabling information disclosure or code execution depending on memory layout and application context.
In the same product, most dangerous first.