Vulnerability identifier: #VU62914

Vulnerability risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-23562

CWE-ID: CWE-190

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
TensorFlow
Server applications / Other server solutions

Vendor: TensorFlow

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in implementation of Range. A remote user can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

TensorFlow: 2.7.0, 2.6.0 - 2.6.2, 2.5.0 - 2.5.2, 2.4.0 - 2.4.4, 2.3.0 - 2.3.4, 2.1.0 - 2.1.4, 2.2.0 - 2.2.3, 2.0.0 - 2.0.4

---

External links
http://github.com/tensorflow/tensorflow/commit/f0147751fd5d2ff23251149ebad9af9f03010732
http://github.com/tensorflow/tensorflow/pull/51733
http://github.com/tensorflow/tensorflow/security/advisories/GHSA-qx3f-p745-w4hr
http://github.com/tensorflow/tensorflow/issues/52676

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.