VYPR
High severityNVD Advisory· Published Mar 24, 2023· Updated Feb 19, 2025

TensorFlow has Null Pointer Error in LookupTableImportV2

CVE-2023-25672

Description

TensorFlow is an open source platform for machine learning. The function tf.raw_ops.LookupTableImportV2 cannot handle scalars in the values parameter and gives an NPE. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.11.12.11.1
tensorflow-cpuPyPI
< 2.11.12.11.1
tensorflow-gpuPyPI
< 2.11.12.11.1

Affected products

1

Patches

1
980b22536abc

Fixes shape inference of LookupTableImportV2 to handle scalar values.

https://github.com/tensorflow/tensorflowPeng WangJan 31, 2023via ghsa
2 files changed · +18 2
  • tensorflow/core/ops/lookup_ops.cc+3 2 modified
    @@ -309,9 +309,10 @@ REGISTER_OP("LookupTableImportV2")
     
           ShapeHandle keys;
           TF_RETURN_IF_ERROR(c->WithRank(c->input(1), 1, &keys));
    +      ShapeHandle values;
    +      TF_RETURN_IF_ERROR(c->WithRankAtLeast(c->input(2), 1, &values));
           DimensionHandle unused;
    -      TF_RETURN_IF_ERROR(
    -          c->Merge(c->Dim(keys, 0), c->Dim(c->input(2), 0), &unused));
    +      TF_RETURN_IF_ERROR(c->Merge(c->Dim(keys, 0), c->Dim(values, 0), &unused));
           return OkStatus();
         });
     
    
  • tensorflow/python/kernel_tests/data_structures/lookup_ops_test.py+15 0 modified
    @@ -41,6 +41,7 @@
     from tensorflow.python.framework import test_util
     from tensorflow.python.ops import array_ops
     from tensorflow.python.ops import control_flow_ops
    +from tensorflow.python.ops import gen_lookup_ops
     from tensorflow.python.ops import lookup_ops
     from tensorflow.python.ops import map_fn
     from tensorflow.python.ops import variables
    @@ -573,6 +574,20 @@ def false_fn():
         self.evaluate(lookup_ops.tables_initializer())
         self.assertAllEqual(grad, -10.)
     
    +  def testImportShapeInference(self, is_anonymous):
    +    v = variables.Variable(1)
    +
    +    @def_function.function(jit_compile=True)
    +    def foo():
    +      return gen_lookup_ops.lookup_table_import_v2(
    +          table_handle=v.handle, keys=[1.1, 2.2], values=1
    +      )
    +
    +    with self.assertRaisesRegex(
    +        ValueError, r"Shape must be at least rank 1 but is rank 0"
    +    ):
    +      foo()
    +
       def testExportShapeInference(self, is_anonymous):
         table = self.getHashTable()(
             lookup_ops.KeyValueTensorInitializer(
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.