Cyber Resilience

CVE-2022-23593

MediumPublic PoC

Published: 04 February 2022

Published
04 February 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0031 54.5th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-23593 is a medium-severity Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability in Google Tensorflow. Its CVSS base score is 5.9 (Medium).

Operationally, ranked in the top 45.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

This vulnerability is AI-related — categorised as Deep Learning Frameworks.

EU & UK References

Vulnerability details

Tensorflow is an Open Source Machine Learning Framework. The `simplifyBroadcast` function in the MLIR-TFRT infrastructure in TensorFlow is vulnerable to a segfault (hence, denial of service), if called with scalar shapes. If all shapes are scalar, then `maxRank` is 0,…

more

so we build an empty `SmallVector`. The fix will be included in TensorFlow 2.8.0. This is the only affected version.

CWE(s)

AI Security AnalysisAI

AI Category
Deep Learning Frameworks
Risk Domain
N/A
OWASP Top 10 for LLMs 2025
None mapped
Classification Reason
Matched keywords: tensorflow, machine learning, tensorflow, tensorflow

Related Threats

Affected Assets

google
tensorflow
2.7.0 — 2.8.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-754

Requires detection and response to audit logging failures as an unusual or exceptional condition.

addresses: CWE-754

Implements detection of unusual or exceptional conditions followed by safe mode entry, reducing the window for exploitation of unchecked conditions.

addresses: CWE-754

Training ensures users perform required checks for unusual or exceptional conditions as part of contingency roles, limiting attacker leverage from skipped validations.

addresses: CWE-754

IR testing directly validates checks for unusual or exceptional conditions that could indicate security incidents.

addresses: CWE-754

Requires ongoing monitoring of organization-defined metrics and analysis, enabling checks for unusual or exceptional conditions.

addresses: CWE-754

Security testing routinely checks for unusual or exceptional inputs/conditions, identifying missing validation steps that flaw remediation then resolves.

addresses: CWE-754

Requires detection of unusual conditions followed by a controlled transition to the defined failure state.

addresses: CWE-754

MTTF determination forces explicit checks for conditions that precede predictable component failure.

References