TensorFlowGHSA-5qw5-89mw-wcg2

Out of bounds write in Tensorflow

CVE-2022-23566 · Published Feb 9, 2022 · updated Jul 13, 2026

High8.8

Fix: upgrade to 2.5.3 or later (3 fixed versions below)

Impact

TensorFlow is vulnerable to a heap OOB write in [Grappler](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/graph_properties.cc#L1132-L1141):

```cc

Status SetUnknownShape(const NodeDef* node, int output_port) {

shape_inference::ShapeHandle shape =

GetUnknownOutputShape(node, output_port);

InferenceContext* ctx = GetContext(node);

if (ctx == nullptr) {

return errors::InvalidArgument("Missing context");

}

ctx->set_output(output_port, shape);

return Status::OK();

}

The [set_output](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.h#L394) function writes to an array at the specified index:

```cc

void set_output(int idx, ShapeHandle shape) { outputs_.at(idx) = shape; }

Hence, this gives a malicious user a write primitive.

Patches

We have patched the issue in GitHub commit [97282c6d0d34476b6ba033f961590b783fa184cd](https://github.com/tensorflow/tensorflow/commit/97282c6d0d34476b6ba033f961590b783fa184cd).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information

Please consult [our security...

Affected versions

Package	Affected	Fixed in
tensorflow PyPI	< 2.5.3	2.5.3
	>= 2.6.0, < 2.6.3	2.6.3
	>= 2.7.0, < 2.7.1	2.7.1

Details and references

### Impact TensorFlow is vulnerable to a heap OOB write in [Grappler](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/costs/graph_properties.cc#L1132-L1141): ```cc Status SetUnknownShape(const NodeDef* node, int output_port) { shape_inference::ShapeHandle shape = GetUnknownOutputShape(node, output_port); InferenceContext* ctx = GetContext(node); if (ctx == nullptr) { return errors::InvalidArgument("Missing context"); } ctx->set_output(output_port, shape); return Status::OK(); } ``` The [`set_output`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/shape_inference.h#L394) function writes to an array at the specified index: ```cc void set_output(int idx, ShapeHandle shape) { outputs_.at(idx) = shape; } ``` Hence, this gives a malicious user a write primitive. ### Patches We have patched the issue in GitHub commit [97282c6d0d34476b6ba033f961590b783fa184cd](https://github.com/tensorflow/tensorflow/commit/97282c6d0d34476b6ba033f961590b783fa184cd). The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-787
Also known as: BIT-tensorflow-2022-23566, CVE-2022-23566, PYSEC-2022-130, PYSEC-2022-75, PYSEC-2026-3109

More TensorFlow advisories

All TensorFlow

High 7.6Feb 9, 2022

Use after free in `DecodePng` kernelCVE-2022-23584fixed in 2.5.3 +2 High 6.5Feb 9, 2022

Reachable Assertion in TensorflowCVE-2022-23564fixed in 2.5.3 +2 High 7.1Feb 9, 2022

Insecure temporary file in TensorflowCVE-2022-23563fixed in 2.5.3 +2 High 7.6Feb 9, 2022

Integer overflow in TensorflowCVE-2022-23562fixed in 2.5.3 +2 High 8.8Feb 9, 2022

Out of bounds write in TFLiteCVE-2022-23561fixed in 2.5.3 +2 High 8.8Feb 9, 2022

Read and Write outside of bounds in TensorFlowCVE-2022-23560fixed in 2.5.3 +2