TensorFlowGHSA-8cxv-76p7-jxwr

Null-dereference in Tensorflow

CVE-2022-23577 · Published Feb 10, 2022 · updated Jul 13, 2026

High6.5

Fix: upgrade to 2.5.3 or later (3 fixed versions below)

Impact

The [implementation of GetInitOp](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/cc/saved_model/loader_util.cc#L31-L61) is vulnerable to a crash caused by dereferencing a null pointer:

```cc

const auto& init_op_sig_it =

meta_graph_def.signature_def().find(kSavedModelInitOpSignatureKey);

if (init_op_sig_it != sig_def_map.end()) {

*init_op_name = init_op_sig_it->second.outputs()

.find(kSavedModelInitOpSignatureKey)

->second.name();

return Status::OK();

}

Here, we have a nested map and we assume that if the first .find succeeds then so would be the search in the internal map. However, the maps are built based on the SavedModel protobuf format and a malicious user can alter that on disk before loading to cause the second .find to return nullptr.

Patches

We have patched the issue in GitHub commit [4f38b1ac8e42727e18a2f0bde06d3bee8e77b250](https://github.com/tensorflow/tensorflow/commit/4f38b1ac8e42727e18a2f0bde06d3bee8e77b250).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

For more information

Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md)...

Affected versions

Package	Affected	Fixed in
tensorflow PyPI	< 2.5.3	2.5.3
	>= 2.6.0, < 2.6.3	2.6.3
	>= 2.7.0, < 2.7.1	2.7.1

Details and references

### Impact The [implementation of `GetInitOp`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/cc/saved_model/loader_util.cc#L31-L61) is vulnerable to a crash caused by dereferencing a null pointer: ```cc const auto& init_op_sig_it = meta_graph_def.signature_def().find(kSavedModelInitOpSignatureKey); if (init_op_sig_it != sig_def_map.end()) { *init_op_name = init_op_sig_it->second.outputs() .find(kSavedModelInitOpSignatureKey) ->second.name(); return Status::OK(); } ``` Here, we have a nested map and we assume that if the first `.find` succeeds then so would be the search in the internal map. However, the maps are built based on the `SavedModel` protobuf format and a malicious user can alter that on disk before loading to cause the second `.find` to return `nullptr`. ### Patches We have patched the issue in GitHub commit [4f38b1ac8e42727e18a2f0bde06d3bee8e77b250](https://github.com/tensorflow/tensorflow/commit/4f38b1ac8e42727e18a2f0bde06d3bee8e77b250). The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-476
Also known as: BIT-tensorflow-2022-23577, CVE-2022-23577, PYSEC-2022-141, PYSEC-2022-86, PYSEC-2026-3135

More TensorFlow advisories

All TensorFlow

Medium 6.5Feb 10, 2022

`CHECK`-failures in binary ops in TensorflowCVE-2022-23583fixed in 2.5.3 +2 Medium 6.5Feb 10, 2022

`CHECK`-failures in `TensorByteSize` in TensorflowCVE-2022-23582fixed in 2.5.3 +2 Medium 6.5Feb 10, 2022

`CHECK`-failures during Grappler's `SafeToRemoveIdentity` in TensorflowCVE-2022-23579fixed in 2.5.3 +2 Medium 4.3Feb 10, 2022

Memory leak in TensorflowCVE-2022-23578fixed in 2.5.3 +2 High 6.5Feb 10, 2022

Integer overflow in TensorflowCVE-2022-23575fixed in 2.5.3 +2 High 6.5Feb 10, 2022

Integer overflow in TensorflowCVE-2022-23576fixed in 2.5.3 +2