CVE-2023-25663: TensorFlow Null Pointer Error in TensorArrayConcatV2
Summary
CVE-2023-25663: TensorFlow has Null Pointer Error in TensorArrayConcatV2. Affects tensorflow versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
The same CVE-2023-25663 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in TensorFlow that can lead to a null pointer error in the TensorArrayConcatV2 function.
Vulnerability Detail
The vulnerability arises when the ctx->step_container() is a null pointer. In such cases, the Lookup function is executed with a null pointer, resulting in a null pointer error. This vulnerability can be triggered by calling the TensorArrayConcatV2 function with specific parameters. An example of triggering the vulnerability is as follows:
import tensorflow as tf
tf.raw_ops.TensorArrayConcatV2(handle=['a', 'b'], flow_in = 0.1, dtype=tf.int32, element_shape_except0=1)
The impact of this vulnerability can vary depending on the context in which TensorFlow is used. However, it can potentially lead to crashes, unexpected behavior, or even remote code execution.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, users can minimize the risk by ensuring they are using the latest patched versions of TensorFlow.
Conclusion
TensorFlow has been found to have a vulnerability that can result in a null pointer error in the TensorArrayConcatV2 function. The TensorFlow team has addressed this vulnerability and will release patched versions (2.12.0 and 2.11.1) to mitigate the risk. Users are advised to update their TensorFlow installations once the patched versions are available. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google.
The impact can vary, but it can potentially lead to crashes, unexpected behavior, or remote code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. No signup is required, and you can simply provide your Pipfile.lock to analyze your dependencies.
To fix this vulnerability, update your TensorFlow installation to the patched versions (2.12.0 or 2.11.1) once they are released.
There is no specific workaround provided, but using the latest patched versions of TensorFlow can minimize the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
