Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.2

TensorFlow may copy uninitialized data causing unpredictable results

CVE-2022-23573 · published 4 years ago
Summary

TensorFlow versions 2.5.3 through 2.8.0 can copy data that hasn't been set up, which may lead to unexpected behavior in your machine‑learning jobs. The issue occurs when assigning values without confirming both sides are ready. Updating to TensorFlow 2.8.0 or applying the back‑ported fixes for 2.7.1, 2.6.3, and 2.5.3 resolves the problem.

What to do
  • Update google inc. tensorflow to version 2.5.3.
  • Update google inc. tensorflow to version 2.6.3.
  • Update google inc. tensorflow to version 2.7.1.
  • Update google tensorflow-gpu to version 2.5.3.
  • Update google tensorflow-gpu to version 2.6.3.
  • Update google tensorflow-gpu to version 2.7.1.
  • Update google inc. tensorflow-cpu to version 2.5.3.
  • Update google inc. tensorflow-cpu to version 2.6.3.
  • Update google inc. tensorflow-cpu to version 2.7.1.
Affected software
Ecosystem VendorProductAffected versions
pip google inc. tensorflow < 2.5.3
>= 2.6.0, < 2.6.3
2.7.0
Fix: upgrade to 2.5.3
pip google tensorflow-gpu < 2.5.3
>= 2.6.0, < 2.6.3
2.7.0
Fix: upgrade to 2.5.3
pip google inc. tensorflow-cpu < 2.5.3
>= 2.6.0, < 2.6.3
2.7.0
Fix: upgrade to 2.5.3
– google tensorflow <= 2.5.2
>= 2.6.0, <= 2.6.2
2.7.0
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Original advisory text
Uninitialized variable access in Tensorflow
Tensorflow is an Open Source Machine Learning Framework. The implementation of `AssignOp` can result in copying uninitialized data to a new tensor. This later results in undefined behavior. The implementation has a check that the left hand side of the assignment is initialized (to minimize number of allocations), but does not check that the right hand side is also initialized. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.2 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-908Use of Uninitialized Resource
Timeline
Published4 Feb 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-q85f-69q7-55h2 · GHSA
CVE-2022-23573 · NVD
CVE-2022-23573 · OSV
Track software like this
Free during beta