CVE-2023-25673: TensorFlow GPU Floating Point Exception in TensorListSplit with XLA
Summary
CVE-2023-25673: TensorFlow has Floating Point Exception in TensorListSplit with XLA. Affects tensorflow-gpu versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2023-25673 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning library that provides a comprehensive ecosystem for building and deploying machine learning models. It supports various tasks, including deep learning, and is widely used in both research and production environments. TensorFlow GPU is a variant optimized for performance on NVIDIA GPUs, enabling faster computation. However, it is susceptible to vulnerabilities that can affect its stability and reliability, such as the Floating Point Exception (FPE) in the TensorListSplit operation when using XLA (Accelerated Linear Algebra).
Vulnerability Detail
The vulnerability identified as CVE-2023-25673 pertains to a Floating Point Exception (FPE) that occurs in the TensorListSplit operation when compiled with XLA. This issue arises when the 'element_shape' parameter is set to -1, which can lead to unexpected behavior or crashes during execution. The vulnerability can be exploited by crafting specific input parameters, potentially resulting in application instability or denial of service. The technical details indicate that the issue is rooted in the handling of tensor operations within the TensorFlow framework.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-gpu==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the TensorListSplit operation with an 'element_shape' of -1. Instead, ensure that the 'element_shape' parameter is set to a valid value that does not lead to a Floating Point Exception. Here is an example of how to modify the code:
import tensorflow as tf
func = tf.raw_ops.TensorListSplit
para = {'tensor': [1], 'element_shape': [1], 'lengths': [0]}
@tf.function(jit_compile=True)
def fuzz_jit():
y = func(**para)
return y
print(fuzz_jit())
Conclusion
The CVE-2023-25673 vulnerability in TensorFlow GPU presents a significant risk due to the Floating Point Exception in the TensorListSplit operation. Users are strongly advised to update to the patched version to mitigate potential impacts. For those unable to update immediately, a workaround is available to prevent exploitation of the vulnerability.
See every vulnerability recorded for tensorflow-gpu →
FAQ
CVE-2023-25673 is a vulnerability in TensorFlow GPU that causes a Floating Point Exception in the TensorListSplit operation when using XLA.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to application instability, crashes, or denial of service due to unexpected behavior in tensor operations.
You can update TensorFlow GPU by running the command 'pip install --upgrade tensorflow-gpu' in your terminal.
If you cannot update immediately, avoid using the TensorListSplit operation with an 'element_shape' of -1 as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
