CVE-2022-23563

Tensorflow is an Open Source Machine Learning Framework. In multiple places, TensorFlow uses `tempfile.mktemp` to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in `mktemp` and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness). In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the `mktemp` function usage. We have patched the issue in several commits, replacing `mktemp` with the safer `mkstemp`/`mkdtemp` functions, according to the usage pattern. Users are advised to upgrade as soon as possible.

• CVE ID
• CVE-2022-23563

• Assigner
• security-advisories@github.com

• Vulnerability Status
• Analyzed

• Published Version
• 2022-02-04T23:15:13

• Last Modified Date
• 2022-02-09T18:30:46

• Version
• 2.0

• Vector String
• AV:L/AC:M/Au:N/C:P/I:P/A:N

• Access Vector
• LOCAL

• Access Compatibility
• MEDIUM

• Authentication
• NONE

• Confidentiality Impact
• PARTIAL

• Integrity Impact
• PARTIAL

• Availability Impact
• NONE

• Base Score
• 3.3

• Severity
• LOW

• Exploitability Score
• 3.4

• Impact Score
• 4.9

• Version
• 3.1

• Vector String
• CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

• Attack Vector
• LOCAL

• Attack Compatibility
• HIGH

• Privileges Required
• LOW

• User Interaction
• NONE

• Scope
• UNCHANGED

• Confidentiality Impact
• HIGH

• Availability Impact
• NONE

• Base Score
• 6.3

• Base Severity
• MEDIUM

• Exploitability Score
• 1

• Impact Score
• 5.2