CVE-2023-25674: TensorFlow Null Pointer Error in RandomShuffle with XLA Enabled
Summary
CVE-2023-25674: TensorFlow has Null Pointer Error in RandomShuffle with XLA enable. Affects tensorflow versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
The same CVE-2023-25674 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework that provides a comprehensive ecosystem for building and deploying machine learning models. It supports various tasks, including deep learning, and offers tools for both research and production. The framework is widely used due to its flexibility, scalability, and extensive community support. However, like any complex software, TensorFlow can have vulnerabilities that may affect its functionality and security.
Vulnerability Detail
The vulnerability identified as CVE-2023-25674 is a Null Pointer Error (NPE) that occurs in the RandomShuffle operation when XLA (Accelerated Linear Algebra) is enabled. This issue arises when specific parameters are passed to the RandomShuffle function, leading to a crash or unexpected behavior in applications using TensorFlow. The potential ramifications include application instability and the inability to perform random shuffling operations, which are critical in many machine learning workflows.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the RandomShuffle operation with the specified parameters that trigger the Null Pointer Error. Here is an example of the code that should be modified:
import tensorflow as tf
func = tf.raw_ops.RandomShuffle
para = {'value': 1e+20, 'seed': -4294967297, 'seed2': -2147483649}
@tf.function(jit_compile=True)
def test():
# Modify parameters to avoid NPE
para['seed'] = 0
para['seed2'] = 0
y = func(**para)
return y
test()
Conclusion
CVE-2023-25674 is a significant vulnerability in TensorFlow that can lead to application instability due to a Null Pointer Error in the RandomShuffle operation. Users are advised to update to the latest version or implement workarounds to mitigate the issue. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for tensorflow →
FAQ
CVE-2023-25674 is a vulnerability in TensorFlow that causes a Null Pointer Error in the RandomShuffle operation when XLA is enabled.
This vulnerability can lead to application crashes and instability when using the RandomShuffle operation with specific parameters.
The vulnerability affects TensorFlow versions prior to 2.12.0 and specific configurations in 2.11.1.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without signing up.
If you cannot update TensorFlow, consider modifying the parameters used in the RandomShuffle operation to avoid triggering the Null Pointer Error.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
