CVE-2022-23565:
`CHECK`-failures in Tensorflow
6.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.30463%
CWE
Published
2/9/2022
Updated
11/13/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| tensorflow | pip | < 2.5.3 | 2.5.3 |
| tensorflow | pip | >= 2.6.0, < 2.6.3 | 2.6.3 |
| tensorflow | pip | = 2.7.0 | 2.7.1 |
| tensorflow-cpu | pip | < 2.5.3 | 2.5.3 |
| tensorflow-cpu | pip | >= 2.6.0, < 2.6.3 | 2.6.3 |
| tensorflow-cpu | pip | = 2.7.0 | 2.7.1 |
| tensorflow-gpu | pip | < 2.5.3 | 2.5.3 |
| tensorflow-gpu | pip | >= 2.6.0, < 2.6.3 | 2.6.3 |
| tensorflow-gpu | pip | = 2.7.0 | 2.7.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from a DCHECK assertion in RepeatedAttrDefEqual that enforced AttrDef name uniqueness. The patch replaced this assertion with an error log (commit c2b31ff). This matches the vulnerability description of CHECK-failures caused by duplicated AttrDefs. The function's role in comparing operation attributes and the direct modification in the security patch provide high confidence in this assessment.