CVE-2022-23563 (CNNVD-202202-396)
中文标题:
Google Tensorflow 安全漏洞
英文标题:
Insecure temporary file in Tensorflow
漏洞描述
中文描述:
Google TensorFlow是美国谷歌（Google）公司的一套用于机器学习的端到端开源平台。 Tensorflow 存在安全漏洞，该漏洞源于 TensorFlow 使用 tempfile.mktemp 来创建临时文件。虽然这在测试中是可以接受的，但在实用程序和库中这是危险的，因为不同的进程可以在检查 mktemp 中的文件名和通过后续操作实际创建文件之间创建文件（TOC/TOU 类型弱点）。
英文描述:
Tensorflow is an Open Source Machine Learning Framework. In multiple places, TensorFlow uses `tempfile.mktemp` to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in `mktemp` and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness). In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the `mktemp` function usage. We have patched the issue in several commits, replacing `mktemp` with the safer `mkstemp`/`mkdtemp` functions, according to the usage pattern. Users are advised to upgrade as soon as possible.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| tensorflow | tensorflow | >= 2.7.0, < 2.7.1 | - | - |
cpe:2.3:a:tensorflow:tensorflow:>=_2.7.0,_<_2.7.1:*:*:*:*:*:*:*
|
| tensorflow | tensorflow | >= 2.6.0, < 2.6.3 | - | - |
cpe:2.3:a:tensorflow:tensorflow:>=_2.6.0,_<_2.6.3:*:*:*:*:*:*:*
|
| tensorflow | tensorflow | < 2.5.3 | - | - |
cpe:2.3:a:tensorflow:tensorflow:<_2.5.3:*:*:*:*:*:*:*
|
| tensorflow | * | - | - |
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
|
|
| tensorflow | 2.7.0 | - | - |
cpe:2.3:a:google:tensorflow:2.7.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2022-23563 |
2025-11-11 15:21:18 | 2025-11-11 07:37:20 |
| NVD | nvd_CVE-2022-23563 |
2025-11-11 14:58:14 | 2025-11-11 07:45:36 |
| CNNVD | cnnvd_CNNVD-202202-396 |
2025-11-11 15:10:49 | 2025-11-11 07:57:09 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202202-396
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 3 -> 5
- data_sources: ['cve'] -> ['cve', 'nvd']