CVE-2023-25665: TensorFlow Null Pointer Error in SparseSparseMaximum
Summary
CVE-2023-25665: TensorFlow has Null Pointer Error in SparseSparseMaximum. Affects tensorflow versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
The same CVE-2023-25665 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning library widely used for various applications, including deep learning and neural networks. It provides a flexible ecosystem for building and deploying machine learning models. However, like any complex software, TensorFlow can have vulnerabilities that may affect its functionality and security. This specific vulnerability relates to the SparseSparseMaximum operation, which can lead to a null pointer error when provided with invalid sparse tensor inputs.
Vulnerability Detail
The vulnerability arises in the SparseSparseMaximum operation of TensorFlow when it receives invalid sparse tensors as inputs. This can lead to a Null Pointer Exception (NPE), causing the application to crash or behave unexpectedly. For instance, if the operation is called with improperly defined sparse tensors, it can disrupt the execution flow, potentially leading to data loss or application downtime. The technical details indicate that the issue can be triggered by specific input configurations, as demonstrated in the provided code example.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the inputs to the SparseSparseMaximum operation are valid sparse tensors. For example, avoid passing empty indices or mismatched shapes. Here is an example of valid input:
import tensorflow as tf
a_indices = [[1]]
a_values = [0.1]
a_shape = [2]
b_indices = [[0]]
b_values = [2]
b_shape = [2]
result = tf.raw_ops.SparseSparseMaximum(
a_indices=a_indices,
a_values=a_values,
a_shape=a_shape,
b_indices=b_indices,
b_values=b_values,
b_shape=b_shape,
)
Conclusion
In summary, CVE-2023-25665 is a significant vulnerability in TensorFlow that can lead to application crashes due to null pointer errors when invalid inputs are provided to the SparseSparseMaximum operation. It is crucial to update to the patched version or validate inputs to mitigate risks.
See every vulnerability recorded for tensorflow →
FAQ
CVE-2023-25665 is a vulnerability in TensorFlow that can cause a Null Pointer Exception when invalid sparse tensors are passed to the SparseSparseMaximum operation.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
You can update TensorFlow by running the command 'pip install --upgrade tensorflow' in your terminal to ensure you have the patched version.
If you cannot update TensorFlow right away, ensure that you validate the inputs to the SparseSparseMaximum operation to prevent triggering the null pointer error.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
