CVE-2023-25665: TensorFlow GPU Null Pointer Error in SparseSparseMaximum
Summary
CVE-2023-25665: TensorFlow has Null Pointer Error in SparseSparseMaximum. Affects tensorflow-gpu versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2023-25665 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework that provides a comprehensive ecosystem for building and deploying machine learning models. It supports a variety of tasks, including deep learning, and is widely used in both research and production environments. TensorFlow GPU is a variant optimized for performance on NVIDIA GPUs, enabling faster computations. However, like any complex software, it can have vulnerabilities that may affect its stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2023-25665 in TensorFlow GPU arises from a Null Pointer Error (NPE) when the SparseSparseMaximum operation is provided with invalid sparse tensor inputs. This can lead to unexpected behavior or crashes in applications using this operation, potentially compromising the integrity of the application and affecting user experience. The issue is triggered when the input tensors do not conform to expected formats, which can occur in various scenarios, particularly when dealing with dynamic data.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-gpu==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the inputs to the SparseSparseMaximum operation are valid sparse tensors. For example, check that the indices and values are correctly defined and that the shapes of the tensors are appropriate. Here is an example of valid input:
import tensorflow as tf
a_indices = [[1]]
a_values = [0.1]
a_shape = [2]
b_indices = [[0]]
b_values = [2]
b_shape = [2]
result = tf.raw_ops.SparseSparseMaximum(
a_indices=a_indices,
a_values=a_values,
a_shape=a_shape,
b_indices=b_indices,
b_values=b_values,
b_shape=b_shape,
)
Conclusion
CVE-2023-25665 is a significant vulnerability in TensorFlow GPU that can lead to Null Pointer Errors when invalid sparse tensors are used. Users are advised to update to version 2.11.1 or later to mitigate this issue. Additionally, validating tensor inputs can help prevent this error from occurring.
See every vulnerability recorded for tensorflow-gpu →
FAQ
CVE-2023-25665 is a vulnerability in TensorFlow GPU that causes a Null Pointer Error when invalid sparse tensors are used in the SparseSparseMaximum operation.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring installation.
The vulnerability can lead to application crashes or unexpected behavior, potentially compromising the stability and reliability of applications using TensorFlow GPU.
You can update TensorFlow GPU to the patched version by running the command 'pip install --upgrade tensorflow-gpu' in your terminal.
Yes, ensure that the inputs to the SparseSparseMaximum operation are valid sparse tensors to avoid triggering the Null Pointer Error.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
