CVE-2022-23595: TensorFlow-CPU - Null Pointer Dereference in XLA Compilation Cache
Summary
CVE-2022-23595: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-cpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< e21af685e1828f7ca65038307df5cc06de4479e8
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2022-23595 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and training machine learning models. It provides a comprehensive ecosystem for building and deploying machine learning applications. TensorFlow-CPU is a specific package within TensorFlow that focuses on CPU-based computations. It is commonly used in scenarios where GPU acceleration is not available or required.
Vulnerability Detail
The vulnerability (CVE-2022-23595) in TensorFlow-CPU arises when building an XLA compilation cache. By default, TensorFlow allows all devices, resulting in a null pointer dereference. In this scenario, the flr->config_proto becomes nullptr, leading to the vulnerability. The impact of this vulnerability is that it can cause the TensorFlow application to crash, potentially disrupting the machine learning workflow. The vulnerability affects versions of TensorFlow-CPU up to 2.5.3, 2.6.3, and 2.7.1.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-cpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-cpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, applying the fix by updating to the patched versions of TensorFlow-CPU is the recommended approach.
Conclusion
The vulnerability (CVE-2022-23595) in TensorFlow-CPU can lead to a null pointer dereference when building an XLA compilation cache. This can cause the TensorFlow application to crash, potentially disrupting the machine learning workflow. It is crucial to update to the patched versions of TensorFlow-CPU (2.8.0, 2.7.1, 2.6.3, or 2.5.3) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open-source machine learning framework used for developing and training machine learning models. It provides a comprehensive ecosystem for building and deploying machine learning applications.
TensorFlow-CPU is a specific package within TensorFlow that focuses on CPU-based computations. It is commonly used in scenarios where GPU acceleration is not available or required.
The vulnerability can cause the TensorFlow application to crash, potentially disrupting the machine learning workflow.
Versions up to 2.5.3, 2.6.3, and 2.7.1 of TensorFlow-CPU are affected by this vulnerability.
Updating to the latest available version of TensorFlow-CPU, which includes the fix, will mitigate this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
