CVE-2022-23559— Integer overflow in TFLite
Quick assessment
Affected
tensorflow tensorflow
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Google TensorFlow是美国谷歌（Google）公司的一套用于机器学习的端到端开源平台。 Tensorflow 存在安全漏洞，攻击者可利用该漏洞可以构建一个TFLite模型，该模型会导致嵌入查找操作中的整数溢出。
Possible ATT&CK Techniques 2 AI
T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-23559
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Integer overflow in TFLite
Source: CVE Program / CVE List V5
Vulnerability Description
Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication. In certain scenarios, this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Vulnerability Title
Google Tensorflow 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Google TensorFlow是美国谷歌（Google）公司的一套用于机器学习的端到端开源平台。 Tensorflow 存在安全漏洞，攻击者可利用该漏洞可以构建一个TFLite模型，该模型会导致嵌入查找操作中的整数溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| tensorflow | tensorflow | >= 2.7.0, < 2.7.1 | - |
|
II. Public POCs for CVE-2022-23559
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-23559
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-23559 (3)
Vendor Advisories for CVE-2022-23559 (1)
-
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-98p5-x8x4-c9m5 x_refsource_CONFIRM
Other References for CVE-2022-23559 (1)
Same Patch Batch · tensorflow · 2022-02-04 · 36 CVEs total
| CVE-2022-23561 | 8.8 HIGH | Out of bounds write in TFLite |
| CVE-2022-23594 | 8.8 HIGH | Out of bounds read in Tensorflow |
| CVE-2022-23587 | 8.8 HIGH | Integer overflow in Tensorflow |
| CVE-2022-23560 | 8.8 HIGH | Read and Write outside of bounds in TFLite |
| CVE-2022-23574 | 8.8 HIGH | Out of bounds read and write in Tensorflow |
| CVE-2022-23566 | 8.8 HIGH | Out of bounds write in Tensorflow |
| CVE-2022-23592 | 8.1 HIGH | Out of bounds read in Tensorflow |
| CVE-2022-23558 | 7.6 HIGH | Integer overflow in TFLite array creation |
| CVE-2022-23562 | 7.6 HIGH | Integer overflow in Tensorflow |
| CVE-2022-23584 | 7.6 HIGH | Use after free in `DecodePng` in Tensorflow |
| CVE-2022-23573 | 7.6 HIGH | Uninitialized variable access in Tensorflow |
| CVE-2022-23591 | 7.5 HIGH | Stack overflow in Tensorflow |
| CVE-2022-23563 | 7.1 HIGH | Insecure temporary file in Tensorflow |
| CVE-2022-23576 | 6.5 MEDIUM | Integer overflow in Tensorflow |
| CVE-2022-23557 | 6.5 MEDIUM | Division by zero in TFLite |
| CVE-2022-23570 | 6.5 MEDIUM | Null-dereference in Tensorflow |
| CVE-2022-23564 | 6.5 MEDIUM | Reachable Assertion in Tensorflow |
| CVE-2022-23565 | 6.5 MEDIUM | `CHECK`-failures in Tensorflow |
| CVE-2022-23582 | 6.5 MEDIUM | `CHECK`-failures in `TensorByteSize` in Tensorflow |
| CVE-2022-23583 | 6.5 MEDIUM | `CHECK`-failures in binary ops in Tensorflow |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: tensorflow
Same vendor: tensorflow
-
CVE-2026-2492
TensorFlow HDF5 Library Uncontrolled Search Path Element Loc -
CVE-2023-33976
TensorFlow segfault in array_ops.upper_bound -
CVE-2024-3660
Arbitrary code injection vulnerability in Keras framework < -
CVE-2023-25661
Denial of Service in TensorFlow -
CVE-2023-25660
TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`
Same weakness: CWE-190
-
CVE-2026-96914
Windows Virtualization-Based Security (VBS) Enclave Elevatio -
CVE-2026-96915
Windows Kernel-Mode Drivers Elevation of Privilege Vulnerabi -
CVE-2026-85363
.NET Framework Elevation of Privilege Vulnerability -
CVE-2026-88163
Microsoft Office SharePoint Remote Code Execution Vulnerabil -
CVE-2026-88166
Microsoft Office SharePoint Remote Code Execution Vulnerabil
V. Comments for CVE-2022-23559
No comments yet