CVE-2023-27579: TensorFlow GPU Floating Point Exception in TFLite Conv Kernel
Summary
CVE-2023-27579: TensorFlow has Floating Point Exception in TFLite in conv kernel. Affects tensorflow-gpu versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2023-27579 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for building and training deep learning models. TensorFlow GPU is a variant that leverages GPU acceleration to enhance performance. The framework supports various operations, including convolutional layers, which are essential for processing image data. However, TensorFlow GPU is susceptible to vulnerabilities that can lead to unexpected behavior, such as floating point exceptions, particularly in its TFLite (TensorFlow Lite) implementation.
Vulnerability Detail
The vulnerability arises when constructing a TFLite model with a parameter 'filter_input_channel' set to less than 1, which results in a Floating Point Exception (FPE). This issue can lead to crashes or undefined behavior during model execution, potentially compromising the integrity of applications relying on TensorFlow for inference tasks. The vulnerability was reported by Wang Xuan of Qihoo 360 AIVul Team and is classified with a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-gpu==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid setting the 'filter_input_channel' parameter to less than 1 when constructing TFLite models. This will prevent the Floating Point Exception from occurring until you can update to the patched version.
Conclusion
In summary, CVE-2023-27579 is a critical vulnerability in TensorFlow GPU that can lead to Floating Point Exceptions when specific parameters are misconfigured. It is essential to update to the patched version to mitigate risks associated with this issue. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for tensorflow-gpu →
FAQ
A Floating Point Exception (FPE) occurs when a program attempts to perform an invalid operation on floating point numbers, such as division by zero or overflow.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include application crashes, undefined behavior during model inference, and possible data integrity issues.
Yes, you should upgrade to TensorFlow GPU version 2.11.1 or later to ensure that the vulnerability is patched.
This vulnerability was reported by Wang Xuan of Qihoo 360 AIVul Team.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
