PT-2022-16089 · Google · Tensorflow

Mihaimaruseac · CVE-2022-23572 · Published 2022-02-04 · Updated 2026-07-09

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.8.0 TensorFlow versions 2.7.1 and earlier TensorFlow versions 2.6.3 and earlier

Description TensorFlow can fail to specialize a type during shape inference. This issue is covered by the DCHECK function, which is a no-op in production builds and an assertion failure in debug builds. As a result, execution proceeds to the ValueOrDie line, causing an assertion failure because ret contains an error Status, not a value. In debug builds, this also results in a crash due to the assertion failure.

Recommendations For versions prior to 2.8.0, update to TensorFlow 2.8.0 or later. For versions 2.7.1 and earlier, update to TensorFlow 2.7.1 or later. For versions 2.6.3 and earlier, update to TensorFlow 2.6.3 or later.

Exploit

Fix

Assertion Failure

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-617

CWE-754

Related Identifiers

BIT-TENSORFLOW-2022-23572

CVE-2022-23572

GHSA-RWW7-2GPW-FV6J

OPENSUSE-SU-2024:12116-1

PYSEC-2022-136

PYSEC-2022-81

PYSEC-2026-3241

Affected Products

Tensorflow

References · 17

• 🔥 https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.cc#L168-L174 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23572.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/cb164786dc891ea11d3a900e90367c339305dc7b · Patch
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rww7-2gpw-fv6j · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23572 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23572 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2022-23572 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-3241 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rww7-2gpw-fv6j · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-136 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-81 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2022-81.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2022-136.yaml · Note
• https://t.me/cvenotify/54274 · Telegram Post