CVE-2022-23590: TensorFlow GPU - Malicious GraphDef Crash Vulnerability
Summary
CVE-2022-23590: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 2 version ranges.
< 2.7.1
< 955059813cc325dc1db5e2daa6221271406d4439
Fixed in 955059813cc325dc1db5e2daa6221271406d4439. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-23590 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive ecosystem for building and training neural networks. TensorFlow GPU is a variant of TensorFlow optimized for GPU acceleration. It leverages the power of GPUs to accelerate the training and inference processes. However, a vulnerability has been discovered in TensorFlow GPU that allows a maliciously altered GraphDef from a TensorFlow SavedModel to cause a TensorFlow process to crash. This vulnerability affects versions prior to TensorFlow 2.7.1 and will be patched in TensorFlow 2.8.0 and TensorFlow 2.7.1.
Vulnerability Detail
The vulnerability arises from the mishandling of a StatusOr value in a TensorFlow SavedModel. An attacker can modify the GraphDef to include a StatusOr value that represents an error. When the TensorFlow process encounters this altered GraphDef, it forcibly extracts the value from the StatusOr, leading to a crash. This vulnerability can be exploited by an attacker with the ability to provide a malicious SavedModel to a TensorFlow GPU process. The crash caused by this vulnerability can disrupt the availability of the TensorFlow GPU process and potentially impact the overall system stability.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
955059813cc325dc1db5e2daa6221271406d4439
This is the first release that contains the fix.
pip install --upgrade "tensorflow-gpu==955059813cc325dc1db5e2daa6221271406d4439"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update TensorFlow GPU to the patched versions as soon as possible to mitigate the risk of exploitation.
Conclusion
The discovered vulnerability in TensorFlow GPU allows a maliciously altered GraphDef to crash TensorFlow GPU processes. It is crucial to update TensorFlow GPU to version 2.7.1 or later to mitigate the risk of exploitation. The TensorFlow team has addressed the issue in multiple GitHub commits, and the fixes will be included in TensorFlow 2.8.0 and TensorFlow 2.7.1. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a variant of TensorFlow optimized for GPU acceleration. It leverages the power of GPUs to accelerate the training and inference processes in machine learning models.
This vulnerability allows a maliciously altered GraphDef from a TensorFlow SavedModel to crash a TensorFlow GPU process. It can disrupt the availability of the process and potentially impact system stability.
Versions prior to TensorFlow 2.7.1 are affected by this vulnerability.
To fix this vulnerability, update TensorFlow GPU to version 2.7.1 or later. The fixes have been included in TensorFlow 2.8.0 and TensorFlow 2.7.1.
No, there is no known workaround for this vulnerability. It is recommended to update TensorFlow GPU to the patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
