CVE-2022-23566: high-severity vulnerability in tensorflow
Out of bounds write in Tensorflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
TensorFlow has a memory vulnerability where a malicious user can write data beyond the intended boundaries of an array in the Grappler component, potentially crashing the application or executing malicious code.
A heap out-of-bounds write vulnerability exists in TensorFlow's `set_output` function within Grappler, allowing an attacker to write to arbitrary memory locations via specially crafted graph inputs. This requires the ability to provide input to the affected function but can result in denial of service or code execution.
In the same product, most dangerous first.