CVE-2022-23583: 
Python vulnerability analysis and mitigation

TensorFlow, an Open Source Machine Learning Framework, was found to contain a vulnerability (CVE-2022-23583) that could allow a malicious user to cause a denial of service through type confusion in binary operations. The vulnerability was discovered and disclosed in February 2022, affecting TensorFlow versions up to 2.5.2, versions 2.6.0 to 2.6.2, and version 2.7.0 (TF Advisory).

The vulnerability occurs when a malicious user alters a SavedModel such that the protobuf part corresponding to tensor arguments is modified, causing the dtype to mismatch with the dtype expected by the operation. This type confusion happens during binary operations when Tin and Tout don't match the type of data in out and input_* tensors, leading to incorrect interpretation by flat<*>. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability results in a denial of service condition through CHECK failures. While in most cases the type confusion would result in silent failures, certain scenarios can trigger a CHECK crash, effectively disrupting the service (TF Advisory).

The vulnerability was patched in TensorFlow 2.8.0. The fix was also backported to TensorFlow 2.7.1, 2.6.3, and 2.5.3. The patch implements validation of real and expected types of arguments to cwise operations, preventing the type confusion issue (TF Advisory, TF Commit).