CVE-2023-33976: TensorFlow CPU Segfault in array_ops.upper_bound
Summary
CVE-2023-33976: TensorFlow has segfault in array_ops.upper_bound. Affects tensorflow-cpu versions < 2.12.1. Fixed in 2.12.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2023-33976 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning library widely used for various applications, including deep learning and neural networks. It provides a flexible architecture for deploying computation across different platforms. The library is designed to facilitate the development and training of machine learning models. However, it is susceptible to vulnerabilities that can lead to application crashes or unexpected behavior, such as the recent segfault issue in the array_ops.upper_bound function.
Vulnerability Detail
The vulnerability arises in the array_ops.upper_bound function, which causes a segmentation fault (segfault) when it is not provided with a rank 2 tensor. This can lead to application crashes, potentially affecting the stability and reliability of applications that rely on TensorFlow for machine learning tasks. The issue was reported by a user and has been identified as a significant risk, especially in production environments where stability is critical.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.12.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-cpu==2.12.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the input tensor provided to the array_ops.upper_bound function is a rank 2 tensor. This can prevent the segfault from occurring until the package is updated. Example code to check tensor rank before calling the function:
import tensorflow as tf
tensor = tf.constant([[1, 2], [3, 4]]) # Ensure this is a rank 2 tensor if len(tensor.shape) == 2: result = tf.experimental.numpy.searchsorted(tensor, 3) else: print('Input tensor must be rank 2.')
Conclusion
The CVE-2023-33976 vulnerability in TensorFlow's array_ops.upper_bound function poses a risk of segmentation faults when incorrect tensor ranks are used. Users are advised to update to version 2.12.1 or later to mitigate this issue. Additionally, ensuring proper tensor ranks can serve as a temporary workaround.
See every vulnerability recorded for tensorflow-cpu →
FAQ
CVE-2023-33976 is a vulnerability in TensorFlow that causes a segmentation fault when the array_ops.upper_bound function is called with an input that is not a rank 2 tensor.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The vulnerability can lead to application crashes, affecting the stability and reliability of applications that utilize TensorFlow for machine learning tasks.
You can update TensorFlow by running the command 'pip install --upgrade tensorflow-cpu' in your terminal or command prompt.
Yes, ensure that the input tensor to the array_ops.upper_bound function is a rank 2 tensor to avoid the segfault until you can update the package.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
