VYPR
← All advisories
High severityNVD Advisory· Published Feb 4, 2022· Updated Apr 22, 2025

Crash when type cannot be specialized in Tensorflow

CVE-2022-23572

Description

Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, TensorFlow can fail to specialize a type during shape inference. This case is covered by the DCHECK function however, DCHECK is a no-op in production builds and an assertion failure in debug builds. In the first case execution proceeds to the ValueOrDie line. This results in an assertion failure as ret contains an error Status, not a value. In the second case we also get a crash due to the assertion failure. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.5.32.5.3
tensorflowPyPI
>= 2.6.0, < 2.6.32.6.3
tensorflowPyPI
>= 2.7.0, < 2.7.12.7.1
tensorflow-cpuPyPI
< 2.5.32.5.3
tensorflow-cpuPyPI
>= 2.6.0, < 2.6.32.6.3
tensorflow-cpuPyPI
>= 2.7.0, < 2.7.12.7.1
tensorflow-gpuPyPI
< 2.5.32.5.3
tensorflow-gpuPyPI
>= 2.6.0, < 2.6.32.6.3
tensorflow-gpuPyPI
>= 2.7.0, < 2.7.12.7.1

Affected products

1

Patches

1
cb164786dc89

Properly handle the case where `SpecializeType()` returns an error `Status`.

https://github.com/tensorflow/tensorflowMihai MaruseacNov 8, 2021via ghsa
commit
1 file changed · +4 −1
  • tensorflow/core/framework/shape_inference.cc+4 −1 modified
    @@ -170,7 +170,10 @@ void InferenceContext::PreInputInit(
     const std::vector<ShapeHandle>& input_tensors_as_shapes) {
   // TODO(mdan): This is also done at graph construction. Run only here instead?
   const auto ret = full_type::SpecializeType(attrs_, op_def);
-  DCHECK(ret.status().ok()) << "while instantiating types: " << ret.status();
+  if (!ret.status().ok()) {
+    construction_status_ = ret.status();
+    return;
+  }
   ret_types_ = ret.ValueOrDie();
 
   input_tensors_ = input_tensors;

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.