CVE-2023-33976: TensorFlow GPU Segfault in array_ops.upper_bound
Summary
CVE-2023-33976: TensorFlow has segfault in array_ops.upper_bound. Affects tensorflow-gpu versions < 2.12.1. Fixed in 2.12.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2023-33976 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework that provides a comprehensive ecosystem for building and deploying machine learning models. It supports various operations, including tensor manipulation, which is crucial for deep learning applications. The framework is widely used in both academia and industry due to its flexibility and scalability. However, like any complex software, it can have vulnerabilities that may affect its stability and security.
Vulnerability Detail
The vulnerability identified as CVE-2023-33976 occurs in the array_ops.upper_bound function of TensorFlow. This function is designed to find the upper bound of values in a tensor. When the function is called with a tensor that is not of rank 2, it leads to a segmentation fault (segfault), causing the application to crash. This issue can arise in scenarios where developers may inadvertently pass tensors of incorrect dimensions, potentially leading to application downtime or data loss.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.12.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-gpu==2.12.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the tensors passed to the array_ops.upper_bound function are always of rank 2. You can implement a check in your code to validate the tensor's shape before calling the function. For example:
import tensorflow as tf
def safe_upper_bound(tensor, value):
if tf.rank(tensor) != 2:
raise ValueError('Input tensor must be of rank 2')
return tf.experimental.numpy.searchsorted(tensor, value)
Conclusion
CVE-2023-33976 is a significant vulnerability in TensorFlow that can lead to application crashes if not addressed. It is crucial for developers to update their TensorFlow GPU packages to the patched version and implement checks in their code to prevent this issue. Utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for tensorflow-gpu →
FAQ
CVE-2023-33976 is a vulnerability in TensorFlow's array_ops.upper_bound function that causes a segmentation fault when a non-rank 2 tensor is provided.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your Pipfile.lock.
The main consequence is that applications using the affected function may crash, leading to potential downtime and data loss.
Yes, a patch is available in TensorFlow version 2.12.1 and later. It is recommended to update to this version to mitigate the issue.
Ensure that you validate the shape of tensors before passing them to the array_ops.upper_bound function to avoid segmentation faults.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
