High severityNVD Advisory· Published Mar 24, 2023· Updated Feb 19, 2025
TensorFlow has Null Pointer Error in LookupTableImportV2
CVE-2023-25672
Description
TensorFlow is an open source platform for machine learning. The function tf.raw_ops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tensorflowPyPI | < 2.11.1 | 2.11.1 |
tensorflow-cpuPyPI | < 2.11.1 | 2.11.1 |
tensorflow-gpuPyPI | < 2.11.1 | 2.11.1 |
Affected products
1- Range: < 2.11.1
Patches
1980b22536abcFixes shape inference of LookupTableImportV2 to handle scalar values.
2 files changed · +18 −2
tensorflow/core/ops/lookup_ops.cc+3 −2 modified@@ -309,9 +309,10 @@ REGISTER_OP("LookupTableImportV2") ShapeHandle keys; TF_RETURN_IF_ERROR(c->WithRank(c->input(1), 1, &keys)); + ShapeHandle values; + TF_RETURN_IF_ERROR(c->WithRankAtLeast(c->input(2), 1, &values)); DimensionHandle unused; - TF_RETURN_IF_ERROR( - c->Merge(c->Dim(keys, 0), c->Dim(c->input(2), 0), &unused)); + TF_RETURN_IF_ERROR(c->Merge(c->Dim(keys, 0), c->Dim(values, 0), &unused)); return OkStatus(); });
tensorflow/python/kernel_tests/data_structures/lookup_ops_test.py+15 −0 modified@@ -41,6 +41,7 @@ from tensorflow.python.framework import test_util from tensorflow.python.ops import array_ops from tensorflow.python.ops import control_flow_ops +from tensorflow.python.ops import gen_lookup_ops from tensorflow.python.ops import lookup_ops from tensorflow.python.ops import map_fn from tensorflow.python.ops import variables @@ -573,6 +574,20 @@ def false_fn(): self.evaluate(lookup_ops.tables_initializer()) self.assertAllEqual(grad, -10.) + def testImportShapeInference(self, is_anonymous): + v = variables.Variable(1) + + @def_function.function(jit_compile=True) + def foo(): + return gen_lookup_ops.lookup_table_import_v2( + table_handle=v.handle, keys=[1.1, 2.2], values=1 + ) + + with self.assertRaisesRegex( + ValueError, r"Shape must be at least rank 1 but is rank 0" + ): + foo() + def testExportShapeInference(self, is_anonymous): table = self.getHashTable()( lookup_ops.KeyValueTensorInitializer(
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-94mm-g2mv-8p7rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-25672ghsaADVISORY
- github.com/tensorflow/tensorflow/commit/980b22536abcbbe1b4a5642fc940af33d8c19b69ghsax_refsource_MISCWEB
- github.com/tensorflow/tensorflow/security/advisories/GHSA-94mm-g2mv-8p7rghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.