CVE-2022-23577: TensorFlow GPU - Null Pointer Dereference in GetInitOp
Summary
CVE-2022-23577: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< 4f38b1ac8e42727e18a2f0bde06d3bee8e77b250
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23577 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive set of tools and libraries for building and training neural networks. TensorFlow GPU is a variant of TensorFlow that leverages the power of GPUs for accelerated computation.
Vulnerability Detail
The vulnerability (CVE-2022-23577) in TensorFlow GPU lies in the implementation of the GetInitOp function. This function is susceptible to a null pointer dereference, which can lead to a crash. An attacker could potentially exploit this vulnerability to cause a denial of service (DoS) attack or execute arbitrary code. The issue has been identified and fixed in TensorFlow 2.8.0, and the fix has also been backported to TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-gpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-gpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround available for this vulnerability. It is advised to update the TensorFlow GPU package to the fixed versions mentioned above.
Conclusion
The vulnerability in TensorFlow GPU (CVE-2022-23577) has been identified and fixed in the latest version, 2.8.0. It is crucial to update the package to the fixed version or apply the respective patches to mitigate the risk of crashes and potential security exploits. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a variant of TensorFlow that utilizes GPUs for accelerated computation, enabling faster training and inference of machine learning models.
The vulnerability in TensorFlow GPU can lead to a crash, potentially causing a denial of service (DoS) attack or enabling an attacker to execute arbitrary code.
The vulnerability affects TensorFlow GPU versions prior to 2.8.0. Specifically, versions 2.7.1, 2.6.3, and 2.5.3 are also impacted.
Yes, the vulnerability has been fixed in TensorFlow GPU version 2.8.0. Additionally, the fix has been backported to TensorFlow versions 2.7.1, 2.6.3, and 2.5.3.
To update TensorFlow GPU, you can use the package manager or the appropriate command for your environment. For example, if you are using pip, you can run 'pip install --upgrade tensorflow-gpu==2.8.0' to update to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
