CVE-2022-23564: Denial of Service Vulnerability in TensorFlow-GPU
Summary
CVE-2022-23564: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< 14fea662350e7c26eb5fe1be2ac31704e5682ee6
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23564 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive ecosystem of tools, libraries, and resources for building and training neural networks. TensorFlow-GPU is a variant of TensorFlow that leverages the power of GPUs for accelerated computation. It allows users to train and run machine learning models on GPUs, enabling faster and more efficient processing of large datasets. However, a vulnerability has been discovered in TensorFlow-GPU that can lead to denial of service attacks.
Vulnerability Detail
The vulnerability in TensorFlow-GPU arises when decoding a resource handle tensor from protobuf. In certain cases, a CHECK assertion can be invalidated based on user-controlled arguments. This can be exploited by attackers to cause denial of service in TensorFlow-GPU processes. By providing specially crafted input, an attacker can trigger the assertion failure, leading to the termination of the TensorFlow-GPU process and potentially disrupting the availability of machine learning services. The vulnerability affects versions of TensorFlow-GPU up to 2.5.3, 2.6.3, and 2.7.1. The TensorFlow team has addressed the issue in TensorFlow 2.8.0 and has also backported the fix to the affected versions.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-gpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-gpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, a denial of service vulnerability has been identified in TensorFlow-GPU versions up to 2.7.1. Attackers can exploit this vulnerability to disrupt machine learning services by triggering a CHECK assertion failure. It is crucial to upgrade to TensorFlow-GPU 2.8.0 or the latest available patch release to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow-GPU is a variant of TensorFlow that utilizes GPUs for accelerated computation, enabling faster training and inference of machine learning models.
The vulnerability allows attackers to cause denial of service in TensorFlow-GPU processes, potentially disrupting machine learning services and impacting availability.
Versions up to 2.5.3, 2.6.3, and 2.7.1 of TensorFlow-GPU are affected by this vulnerability.
To fix the vulnerability, it is recommended to upgrade to TensorFlow-GPU version 2.8.0 or the latest available patch release for affected versions (2.5.3, 2.6.3, or 2.7.1).
No specific workarounds have been provided for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of TensorFlow-GPU.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
