CVE-2022-23575: TensorFlow GPU - Integer Overflow in OpLevelCostEstimator::CalculateTensorSize
Summary
CVE-2022-23575: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< fcd18ce3101f245b083b30655c27b239dc72221e
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23575 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive ecosystem of tools, libraries, and resources for building and training neural networks. TensorFlow GPU is a variant of TensorFlow that leverages the power of GPUs for accelerated computation. It allows users to perform high-performance machine learning tasks on GPU hardware. However, a vulnerability has been discovered in TensorFlow GPU that could potentially be exploited by an attacker.
Vulnerability Detail
The vulnerability, identified as CVE-2022-23575, resides in the implementation of OpLevelCostEstimator::CalculateTensorSize in TensorFlow GPU. It is caused by an integer overflow that can occur when an operation involving a tensor with a large number of elements is created. This integer overflow can lead to unexpected behavior and potentially enable an attacker to execute arbitrary code or cause a denial-of-service condition. The vulnerability affects versions of TensorFlow GPU up to and including 2.5.3, 2.6.3, and 2.7.1. The TensorFlow development team has addressed this issue and plans to release the fix in TensorFlow 2.8.0. Additionally, they have backported the fix to versions 2.5.3, 2.6.3, and 2.7.1 to ensure users on these versions are also protected.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-gpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-gpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix or update to a patched version of TensorFlow GPU as soon as possible.
Conclusion
In conclusion, TensorFlow GPU is vulnerable to an integer overflow in the OpLevelCostEstimator::CalculateTensorSize implementation. This vulnerability can potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. It is crucial to update TensorFlow GPU to version 2.8.0 or apply the backported fix for versions 2.5.3, 2.6.3, and 2.7.1 to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a variant of TensorFlow that utilizes GPU hardware for accelerated machine learning computations.
The vulnerability can potentially allow an attacker to execute arbitrary code or cause a denial-of-service condition.
Versions up to and including 2.5.3, 2.6.3, and 2.7.1 of TensorFlow GPU are affected.
You can fix the vulnerability by updating TensorFlow GPU to version 2.8.0 or applying the backported fix for versions 2.5.3, 2.6.3, and 2.7.1.
No, there is no known workaround for this vulnerability. It is recommended to apply the official fix or update to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
