CVE-2022-23567: Integer Overflow Vulnerability in TensorFlow-GPU
Summary
CVE-2022-23567: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 4 version ranges.
< 1b54cadd19391b60b6fcccd8d076426f7221d5e8
< 2.5.3
>= 2.6.0, < 2.6.3
< e952a89b7026b98fe8cbe626514a93ed68b7c510
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23567 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow-GPU is an open-source machine learning framework that provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. It is widely used in various domains, including research, industry, and academia. TensorFlow-GPU leverages the power of GPUs to accelerate the training and inference processes, making it suitable for large-scale machine learning tasks. However, a vulnerability has been discovered in the implementation of Sparse*Cwise* ops, which can lead to integer overflows and subsequent denial of service attacks or assertion failures.
Vulnerability Detail
The vulnerability in TensorFlow-GPU arises from the lack of proper validation on the shapes of input tensors and the construction of large TensorShape objects with user-provided dimensions. This allows an attacker to trigger integer overflows, leading to large allocations that can cause out-of-memory (OOM) denial of service attacks. Additionally, the vulnerability can result in CHECK failures when building new TensorShape objects, leading to assert failures-based denial of service attacks. The impact of these attacks can range from disrupting the availability of TensorFlow-GPU to potentially causing the entire system to crash. The vulnerability affects versions of TensorFlow-GPU up to 2.5.3.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-gpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-gpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can consider implementing input validation checks in their own code to ensure that the shapes of input tensors are within acceptable limits. Additionally, it is advisable to avoid constructing large TensorShape objects with user-provided dimensions until the vulnerability is fully patched.
Conclusion
The vulnerability in TensorFlow-GPU, identified as CVE-2022-23567, poses a risk of denial of service attacks and assert failures. It is crucial to update to the latest available version of TensorFlow-GPU, which includes the necessary patches to mitigate the vulnerability. Implementing input validation checks and avoiding the construction of large TensorShape objects with user-provided dimensions can serve as temporary workarounds. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow-GPU is an open-source machine learning framework that leverages GPUs to accelerate the training and inference processes of machine learning models.
The vulnerability can be exploited to trigger denial of service attacks, potentially leading to the disruption of TensorFlow-GPU or even crashing the entire system.
Versions of TensorFlow-GPU up to 2.5.3 are affected by this vulnerability.
Yes, the vulnerability has been fixed in TensorFlow 2.8.0. The fix has also been backported to TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3.
To update TensorFlow-GPU, refer to the official documentation provided by the TensorFlow project for detailed instructions.
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
