{"api_version":"1","generated_at":"2026-07-23T12:35:42+00:00","cve":"CVE-2022-23577","urls":{"html":"https://cve.report/CVE-2022-23577","api":"https://cve.report/api/cve/CVE-2022-23577.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-23577","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-23577"},"summary":{"title":"CVE-2022-23577","description":"Tensorflow is an Open Source Machine Learning Framework. The implementation of `GetInitOp` is vulnerable to a crash caused by dereferencing a null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2022-02-04 23:15:00","updated_at":"2022-02-10 15:17:00"},"problem_types":["CWE-476"],"metrics":[],"references":[{"url":"https://github.com/tensorflow/tensorflow/commit/4f38b1ac8e42727e18a2f0bde06d3bee8e77b250","name":"https://github.com/tensorflow/tensorflow/commit/4f38b1ac8e42727e18a2f0bde06d3bee8e77b250","refsource":"MISC","tags":[],"title":"Prevent null dereference read in `GetInitOp`. · tensorflow/tensorflow@4f38b1a · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8cxv-76p7-jxwr","name":"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8cxv-76p7-jxwr","refsource":"CONFIRM","tags":[],"title":"Null dereference in `GetInitOp` · Advisory · tensorflow/tensorflow · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/cc/saved_model/loader_util.cc#L31-L61","name":"https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/cc/saved_model/loader_util.cc#L31-L61","refsource":"MISC","tags":[],"title":"tensorflow/loader_util.cc at a1320ec1eac186da1d03f033109191f715b2b130 · tensorflow/tensorflow · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-23577","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-23577","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"23577","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"tensorflow","cpe6":"2.7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"23577","vulnerable":"1","versionEndIncluding":"2.5.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"tensorflow","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"23577","vulnerable":"1","versionEndIncluding":"2.6.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"google","cpe5":"tensorflow","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2022-23577","STATE":"PUBLIC","TITLE":"Null-dereference in Tensorflow"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"tensorflow","version":{"version_data":[{"version_value":"< 2.8.0"}]}}]},"vendor_name":"tensorflow"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Tensorflow is an Open Source Machine Learning Framework. The implementation of `GetInitOp` is vulnerable to a crash caused by dereferencing a null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-476: NULL Pointer Dereference"}]}]},"references":{"reference_data":[{"name":"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8cxv-76p7-jxwr","refsource":"CONFIRM","url":"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-8cxv-76p7-jxwr"},{"name":"https://github.com/tensorflow/tensorflow/commit/4f38b1ac8e42727e18a2f0bde06d3bee8e77b250","refsource":"MISC","url":"https://github.com/tensorflow/tensorflow/commit/4f38b1ac8e42727e18a2f0bde06d3bee8e77b250"},{"name":"https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/cc/saved_model/loader_util.cc#L31-L61","refsource":"MISC","url":"https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/cc/saved_model/loader_util.cc#L31-L61"}]},"source":{"advisory":"GHSA-8cxv-76p7-jxwr","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2022-02-04 23:15:00","lastModifiedDate":"2022-02-10 15:17:00","problem_types":["CWE-476"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"PARTIAL","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:google:tensorflow:2.7.0:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*","versionEndIncluding":"2.5.2","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.0","versionEndIncluding":"2.6.2","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2022","CveId":"23577","Ordinal":"226443","Title":"CVE-2022-23577","CVE":"CVE-2022-23577","Year":"2022"},"notes":[{"CveYear":"2022","CveId":"23577","Ordinal":"1","NoteData":"Tensorflow is an Open Source Machine Learning Framework. The implementation of `GetInitOp` is vulnerable to a crash caused by dereferencing a null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.","Type":"Description","Title":null},{"CveYear":"2022","CveId":"23577","Ordinal":"2","NoteData":"2022-02-04","Type":"Other","Title":"Published"},{"CveYear":"2022","CveId":"23577","Ordinal":"3","NoteData":"2022-02-04","Type":"Other","Title":"Modified"}]}}}