High severityNVD Advisory· Published Mar 24, 2023· Updated Feb 19, 2025
TensorFlow has Null Pointer Error in RandomShuffle with XLA enable
CVE-2023-25674
Description
TensorFlow is an open source machine learning platform. Versions prior to 2.12.0 and 2.11.1 have a null pointer error in RandomShuffle with XLA enabled. A fix is included in TensorFlow 2.12.0 and 2.11.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tensorflowPyPI | < 2.11.1 | 2.11.1 |
tensorflow-cpuPyPI | < 2.11.1 | 2.11.1 |
tensorflow-gpuPyPI | < 2.11.1 | 2.11.1 |
Affected products
1- Range: < 2.11.1
Patches
1728113a3be69[Tensorflow] Fix security vulnerability with TensorListSplitOp
2 files changed · +13 −0
tensorflow/compiler/tests/tensor_list_ops_test.py+11 −0 modified@@ -236,6 +236,17 @@ def testZerosLikeForTensorList(self): self.assertAllEqual(z.shape.as_list(), [None]) self.assertAllEqual(z, [0.0, 0.0]) + def testInvalidSplitLength(self): + with self.session(), self.test_scope(): + tensor_list_split = list_ops.tensor_list_split( + tensor=[1], element_shape=[-1], lengths=[0] + ) + with self.assertRaisesRegex( + errors.UnimplementedError, "All lengths must be positive" + ): + self.evaluate(tensor_list_split) + + if __name__ == "__main__": os.environ["TF_XLA_FLAGS"] = ("--tf_xla_min_cluster_size=2 " + os.environ.get("TF_XLA_FLAGS", ""))
tensorflow/compiler/tf2xla/kernels/tensor_list_ops.cc+2 −0 modified@@ -553,6 +553,8 @@ class TensorListSplitOp : public XlaOpKernel { OP_REQUIRES(ctx, len == length, errors::Unimplemented("All lengths have to be the same")); } + OP_REQUIRES(ctx, length, + errors::Unimplemented("All lengths must be positive")); OP_REQUIRES( ctx, element_dims[0] % length == 0, errors::Unimplemented("Buffer size has to be a multiple of length"));
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-gf97-q72m-7579ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-25674ghsaADVISORY
- github.com/tensorflow/tensorflow/commit/728113a3be690facad6ce436660a0bc1858017faghsax_refsource_MISCWEB
- github.com/tensorflow/tensorflow/security/advisories/GHSA-gf97-q72m-7579ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.