CVE-2022-23568: Integer Overflow in TensorFlow AddManySparseToTensorsMap
Summary
CVE-2022-23568: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 4 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< a68f68061e263a88321c104a6c911fe5598050a8
< b51b82fe65ebace4475e3c54eb089c18a4403f1c
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23568 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive set of tools and libraries for building and training neural networks. TensorFlow is available for multiple programming languages, including Python, C++, and Java. This vulnerability affects the TensorFlow GPU package, which is a Python package that enables GPU acceleration for TensorFlow computations.
Vulnerability Detail
The vulnerability (CVE-2022-23568) in TensorFlow's implementation of AddManySparseToTensorsMap allows an integer overflow to occur. This results in a CHECK-fail when constructing new TensorShape objects, leading to an assert failure-based denial of service. The issue arises due to missing validation on the shapes of input tensors and the direct construction of a large TensorShape with user-provided dimensions. An attacker could exploit this vulnerability to cause a denial of service or potentially execute arbitrary code.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-gpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-gpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update TensorFlow to the fixed versions mentioned above.
Conclusion
The vulnerability in TensorFlow's AddManySparseToTensorsMap implementation poses a risk of denial of service or potential code execution. It is crucial to update TensorFlow to the fixed versions (2.8.0, 2.7.1, 2.6.3, or 2.5.3) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow is an open-source machine learning framework used for developing and deploying machine learning models. It provides tools and libraries for building and training neural networks.
The vulnerability allows an attacker to cause a denial of service or potentially execute arbitrary code by exploiting an integer overflow in TensorFlow's AddManySparseToTensorsMap implementation.
To fix this vulnerability, update TensorFlow to version 2.8.0 or apply the relevant patches. The fix has also been backported to TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3.
No, there is no known workaround for this vulnerability. It is crucial to update TensorFlow to the fixed versions.
For more information about this vulnerability, refer to the official TensorFlow advisory (PYSEC-2022-132) and the associated CVE-2022-23568.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
