CVE-2022-23581

`CHECK`-failures during Grappler's `IsSimplifiableReshape` in Tensorflow

Published Feb 4, 2022 CVSS 3.1 · 6.5 Medium EPSS 1.2% KEV · Not listed
Description
Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `IsSimplifiableReshape` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2022-0329 Tensorflow is an Open Source Machine Learning Framework. The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that `IsSimplifiableReshape` would trigger `CHECK` failures. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
Github GHSA Github GHSA GHSA-fq86-3f29-px2c `CHECK`-failures during Grappler's `IsSimplifiableReshape` in Tensorflow
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Apr 22, 2025, 6:25 PM
Reserved
Jan 19, 2022, 12:00 AM
Status
Modified
Published
Feb 4, 2022, 11:15 PM
Modified
Jun 17, 2026, 4:30 AM