CVE-2022-23577: TensorFlow CPU - Null Pointer Dereference in GetInitOp
Summary
CVE-2022-23577: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-cpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< 4f38b1ac8e42727e18a2f0bde06d3bee8e77b250
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2022-23577 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive set of tools and libraries for building and training neural networks. TensorFlow CPU is a specific package within TensorFlow that focuses on CPU-based computations. It is commonly used in environments where GPU acceleration is not available or required. This vulnerability affects the TensorFlow CPU package and can lead to a crash due to a null pointer dereference.
Vulnerability Detail
The vulnerability in TensorFlow CPU arises from a flaw in the implementation of the GetInitOp function. This function is responsible for initializing operations in TensorFlow. Due to the incorrect handling of certain conditions, a null pointer can be dereferenced, leading to a crash. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) attack or disrupt the execution of TensorFlow-based applications. The impact of this vulnerability can range from a temporary disruption of service to a complete system crash.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-cpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-cpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can consider avoiding the usage of the GetInitOp function in their TensorFlow CPU-based applications. By removing or replacing this function with alternative initialization methods, the vulnerability can be mitigated. However, this workaround may not be feasible in all scenarios and may require modifications to the affected codebase. It is recommended to consult with TensorFlow experts or the package maintainers for guidance on implementing this workaround effectively.
Conclusion
The vulnerability in TensorFlow CPU, CVE-2022-23577, exposes a null pointer dereference issue in the GetInitOp function. This can lead to crashes and potential denial-of-service attacks. It is crucial to update the TensorFlow CPU package to one of the fixed versions (2.8.0, 2.7.1, 2.6.3, or 2.5.3) to mitigate this vulnerability. If you require further assistance or support in addressing this vulnerability, please reach out to DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open-source machine learning framework used for developing and deploying machine learning models. It provides a wide range of tools and libraries for building and training neural networks.
TensorFlow CPU is a specific package within TensorFlow that focuses on CPU-based computations. It is commonly used in environments where GPU acceleration is not available or required.
The vulnerability can lead to a crash in TensorFlow CPU due to a null pointer dereference. This can result in a denial-of-service (DoS) attack or disruption of TensorFlow-based applications.
To fix this vulnerability, update your TensorFlow CPU package to one of the fixed versions: 2.8.0, 2.7.1, 2.6.3, or 2.5.3. Follow the official TensorFlow documentation or consult the package maintainers for specific instructions.
As a temporary workaround, you can avoid using the GetInitOp function in your TensorFlow CPU-based applications. Consult with TensorFlow experts or the package maintainers for guidance on implementing this workaround effectively.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
