CVE-2022-23572: TensorFlow GPU - Failure to Specialize Type during Shape Inference
Summary
CVE-2022-23572: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< cb164786dc891ea11d3a900e90367c339305dc7b
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23572 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive set of tools and libraries for building and training neural networks. TensorFlow GPU is a variant of TensorFlow that leverages GPU acceleration for faster computation.
Vulnerability Detail
Under certain scenarios, TensorFlow GPU fails to specialize a type during shape inference. This issue is covered by the DCHECK function, which is a debugging aid that verifies a condition and aborts the program if it is false. However, in production builds, DCHECK is a no-op and does not trigger an assertion failure. As a result, execution proceeds to the ValueOrDie line, which causes an assertion failure or a crash due to the presence of an error Status instead of a value. This vulnerability can lead to unexpected program behavior, crashes, or denial of service.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-gpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-gpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix or update to the patched versions of TensorFlow GPU as soon as they are released.
Conclusion
The vulnerability in TensorFlow GPU, which causes a failure to specialize a type during shape inference, can lead to unexpected program behavior, crashes, or denial of service. It is crucial for users to update their TensorFlow GPU installations to the fixed versions once they are released. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a variant of TensorFlow that utilizes GPU acceleration for faster computation of machine learning models.
Shape inference is the process of automatically determining the shapes of tensors (multi-dimensional arrays) in a TensorFlow computation graph. It helps ensure compatibility and consistency of tensor shapes throughout the graph.
This vulnerability can be exploited by providing input that triggers the specific scenario where TensorFlow GPU fails to specialize a type during shape inference. However, the exact conditions and inputs required to exploit this vulnerability have not been disclosed to prevent potential misuse.
The consequences of this vulnerability include unexpected program behavior, crashes, or denial of service. Exploiting this vulnerability could lead to the compromise of machine learning models or disruption of critical processes relying on TensorFlow GPU.
No, this vulnerability specifically affects TensorFlow GPU. TensorFlow CPU installations are not impacted by this issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
