CVE-2022-35993: TensorFlow: DoS via malformed SetSize tensor shape

HIGH

Published September 16, 2022

CISO Take

Any TensorFlow deployment (2.7.x–2.9.x) that processes externally-supplied tensor inputs—including ML inference APIs, model serving endpoints, and training pipelines—is vulnerable to remote crash with no authentication required. Patch immediately to 2.10.0, 2.9.1, 2.8.1, or 2.7.2. If patching is delayed, block unauthenticated access to TensorFlow Serving endpoints at the network perimeter.

What is the risk?

CVSS 7.5 is accurate for this context. The NETWORK/LOW/NONE/NONE vector means any internet-exposed TensorFlow Serving or custom inference API is trivially crashable by an unauthenticated attacker. For AI/ML workloads, availability is often as critical as confidentiality—a downed inference endpoint means downed AI-powered products. Risk is lower for air-gapped training clusters but HIGH for any customer-facing ML inference service running affected versions.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
TensorFlow	pip	—	No patch
201.3KOpenSSF 7.63.4K dependentsPushed 6d ago4% patched~1372d to patchFull package profile →

Do you use TensorFlow? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 41% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

5 steps

Patch: Upgrade to TensorFlow 2.10.0, 2.9.1, 2.8.1, or 2.7.2 (commit cf70b79d).
Short-term: Place TensorFlow Serving behind an authenticated API gateway; reject unauthenticated requests at WAF/load balancer.
Input validation: Add shape validation middleware that enforces expected tensor ranks before ops execute.
Detection: Alert on abnormal TF Serving process restarts (SIGABRT/CHECK failure signature in logs).
Blast radius: Ensure inference services run in isolated containers with auto-restart policies so a crash does not cascade to other services.

How is it classified?

DoSFrameworkInferenceAML.T0029- Denial of AI Service AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

8.4-AI system operation and monitoring

NIST AI RMF

MANAGE 2.4-Residual risks are monitored and managedMAP 5.1-Likelihood and magnitude of impacts are assessed

Frequently Asked Questions

What is CVE-2022-35993?

Is CVE-2022-35993 actively exploited?

No confirmed active exploitation of CVE-2022-35993 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-35993?

1. Patch: Upgrade to TensorFlow 2.10.0, 2.9.1, 2.8.1, or 2.7.2 (commit cf70b79d). 2. Short-term: Place TensorFlow Serving behind an authenticated API gateway; reject unauthenticated requests at WAF/load balancer. 3. Input validation: Add shape validation middleware that enforces expected tensor ranks before ops execute. 4. Detection: Alert on abnormal TF Serving process restarts (SIGABRT/CHECK failure signature in logs). 5. Blast radius: Ensure inference services run in isolated containers with auto-restart policies so a crash does not cascade to other services.

What systems are affected by CVE-2022-35993?

This vulnerability affects the following AI/ML architecture patterns: model serving, inference APIs, training pipelines, NLP pipelines, recommendation systems.

What is the CVSS score for CVE-2022-35993?

CVE-2022-35993 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.48%.

What is the AI security impact?

Affected AI Architectures

model servinginference APIstraining pipelinesNLP pipelinesrecommendation systems

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.4

NIST AI RMF: MANAGE 2.4, MAP 5.1

What are the technical details?

Original Advisory

TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_shape` that is not a 1D tensor, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit cf70b79d2662c0d3c6af74583641e345fc939467. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Exploitation Scenario

An adversary targeting an AI-powered product (e.g., a recommendation engine or NLP API backed by TensorFlow Serving) identifies the service version via banner grabbing or error responses. They craft a gRPC or REST inference request for a model endpoint that internally invokes `SetSize`, supplying a 2D tensor where `set_shape` expects a 1D tensor. The CHECK assertion in `set_size_op.cc` fires, killing the serving process. The attacker repeats at a low rate (one malformed request suffices per restart) to maintain a persistent outage. With no authentication required, this is achievable from any internet host.

Weaknesses (CWE)

CWE-617Reachable Assertion

CWE-617 — Reachable Assertion: The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

[Implementation] If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
[Implementation] Consider changing the assertion to some other less "fatal" error. This might not be easy to implement, since other code may be needed to handle the error.

Source: MITRE CWE corpus.