{"data":{"id":"8885f3ce-0c56-4db6-8c76-402279a12558","title":"CVE-2022-23578: Tensorflow is an Open Source Machine Learning Framework. If a graph node is invalid, TensorFlow can leak memory in the…","summary":"TensorFlow contains a memory leak in the implementation of `ImmutableExecutorState::Initialize` when a graph node is invalid. The code sets `item->kernel` to `nullptr`, but because it is a plain `OpKernel*` pointer, the memory previously allocated to it is never freed.","solution":"The fix will be included in TensorFlow 2.8.0. The commit will also be cherrypicked to TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, which are also affected and still in the supported range.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2022-23578","publishedAt":"2022-02-05T04:15:14.553Z","cveId":"CVE-2022-23578","cweIds":["CWE-401"],"cvssScore":"4.3","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["tensorflow@< 2.5.3 (fixed: 2.5.3)","tensorflow@>= 2.6.0, < 2.6.3 (fixed: 2.6.3)","tensorflow@= 2.7.0 (fixed: 2.7.1)","tensorflow-cpu@< 2.5.3 (fixed: 2.5.3)","tensorflow-cpu@>= 2.6.0, < 2.6.3 (fixed: 2.6.3)","tensorflow-cpu@= 2.7.0 (fixed: 2.7.1)","tensorflow-gpu@< 2.5.3 (fixed: 2.5.3)","tensorflow-gpu@>= 2.6.0, < 2.6.3 (fixed: 2.6.3)","tensorflow-gpu@= 2.7.0 (fixed: 2.7.1)"],"affectedPackageNames":["tensorflow","tensorflow-cpu","tensorflow-gpu"],"affectedPackageRefs":["pypi:tensorflow","pypi:tensorflow-cpu","pypi:tensorflow-gpu"],"affectedVendors":["Google"],"affectedVendorsRaw":["TensorFlow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Tensorflow memory leak on invalid graph node in ImmutableExecutorState","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00722,"epssCheckedAt":"2026-11-04T12:08:33.950Z","kevDateAdded":null,"advisoryAliases":["GHSA-8r7c-3cm2-3h8f"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:58:33.868Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2022-02-02T16:55:58.910Z","daysToFix":-3,"fixCheckedAt":"2026-10-29T21:49:11.559Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.5.3","matchedVersion":"2.5.3","fixReleasedAt":"2022-02-02T17:00:33.101Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:11.402Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.5.3","matchedVersion":"2.5.3","fixReleasedAt":"2022-02-02T16:55:58.910Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:49:11.402Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.7.1","matchedVersion":"2.7.1","fixReleasedAt":"2022-02-02T16:58:42.928Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:49:11.402Z"},{"ecosystem":"pypi","name":"tensorflow","fixedVersion":"2.6.3","matchedVersion":"2.6.3","fixReleasedAt":"2022-02-02T16:56:09.440Z","daysToFix":-3,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:49:11.402Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.6.3","matchedVersion":"2.6.3","fixReleasedAt":"2022-02-02T16:57:11.096Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:11.402Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.6.3","matchedVersion":"2.6.3","fixReleasedAt":"2022-02-02T17:00:49.166Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:11.402Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.5.3","matchedVersion":"2.5.3","fixReleasedAt":"2022-02-02T16:56:59.291Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:11.402Z"},{"ecosystem":"pypi","name":"tensorflow-gpu","fixedVersion":"2.7.1","matchedVersion":"2.7.1","fixReleasedAt":"2022-02-02T17:04:59.397Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:11.402Z"},{"ecosystem":"pypi","name":"tensorflow-cpu","fixedVersion":"2.7.1","matchedVersion":"2.7.1","fixReleasedAt":"2022-02-02T17:00:16.748Z","daysToFix":-3,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:49:11.402Z"}]}}