CVE-2022-23580: 
Python vulnerability analysis and mitigation

CVE-2022-23580 is a vulnerability in TensorFlow, an Open Source Machine Learning Framework, discovered in early 2022. The vulnerability allows TensorFlow to allocate a large vector based on a value from a tensor controlled by the user during shape inference operations. This issue affects TensorFlow versions up to 2.5.2, versions 2.6.0 to 2.6.2, and version 2.7.0 (GitHub Advisory).

The vulnerability occurs during shape inference operations where TensorFlow can allocate a vector based on an unchecked tensor value controlled by the user. The issue has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-1284 (Improper Validation of Specified Quantity in Input) and CWE-400 (Uncontrolled Resource Consumption) (NVD).

The vulnerability could lead to resource exhaustion through the allocation of extremely large vectors during shape inference operations, potentially causing system instability or denial of service (GitHub Advisory).

The vulnerability has been patched in TensorFlow 2.8.0. The fix was also backported to TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3. The patch implements a maximum dimension limit of 1<<20 to prevent allocation of extremely large vectors (GitHub Commit).