CVE-2023-25670: TensorFlow GPU Null Pointer Error in QuantizedMatMulWithBiasAndDequantize
Summary
CVE-2023-25670: TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantize. Affects tensorflow-gpu versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2023-25670 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning library widely used for various applications, including deep learning and neural networks. The 'tensorflow-gpu' package enables TensorFlow to leverage GPU acceleration for improved performance. However, it is crucial to maintain the integrity and security of the library, as vulnerabilities can lead to significant issues in applications relying on it.
Vulnerability Detail
The vulnerability identified as CVE-2023-25670 is a Null Pointer Error (NPE) that occurs in the 'QuantizedMatMulWithBiasAndDequantize' function when using the Intel Math Kernel Library (MKL). This error can lead to application crashes or unexpected behavior, potentially compromising the stability of applications that utilize this function. The issue arises from improper handling of input parameters, particularly when certain expected values are not provided, leading to null references during execution.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-gpu==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify your code to ensure that all required parameters for the 'QuantizedMatMulWithBiasAndDequantize' function are provided and valid. Here is an example of how to structure the parameters correctly:
import tensorflow as tf
func = tf.raw_ops.QuantizedMatMulWithBiasAndDequantize
para = {
'a': tf.constant(138, dtype=tf.quint8),
'b': tf.constant(4, dtype=tf.qint8),
'bias': [[31.81644630432129, 47.21876525878906], [109.95201110839844, 152.07968139648438]],
'min_a': 141.5337138686371,
'max_a': [73.84139251708984, 173.15280151367188],
'min_b': [],
'max_b': [[16.128345489501953, 193.26820373535156]],
'min_freezed_output': [],
'max_freezed_output': [115.50032806396484, 156.974853515625],
'Toutput': 1.0,
'transpose_a': True,
'transpose_b': False,
'input_quant_mode': 'MIN_FIRST'
}
func(**para)
Conclusion
CVE-2023-25670 is a significant vulnerability in the TensorFlow GPU package that can lead to application crashes due to a Null Pointer Error. It is essential to update to the patched version to maintain application stability and security. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for tensorflow-gpu →
FAQ
CVE-2023-25670 is a vulnerability in TensorFlow that causes a Null Pointer Error in the QuantizedMatMulWithBiasAndDequantize function when using MKL.
You can check if your application is affected by using the Vulert playground, which monitors open-source vulnerabilities in real-time.
As a temporary measure, ensure that all required parameters for the affected function are provided and valid to avoid triggering the error.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
For more information, consult the TensorFlow security guide available on their GitHub repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
