CVE-2022-35993 — HIGH (CVSS 7.5) AI Security Vulnerability

CISO Take

Any TensorFlow deployment (2.7.x–2.9.x) that processes externally-supplied tensor inputs—including ML inference APIs, model serving endpoints, and training pipelines—is vulnerable to remote crash with no authentication required. Patch immediately to 2.10.0, 2.9.1, 2.8.1, or 2.7.2. If patching is delayed, block unauthenticated access to TensorFlow Serving endpoints at the network perimeter.

Risk Assessment

CVSS 7.5 is accurate for this context. The NETWORK/LOW/NONE/NONE vector means any internet-exposed TensorFlow Serving or custom inference API is trivially crashable by an unauthenticated attacker. For AI/ML workloads, availability is often as critical as confidentiality—a downed inference endpoint means downed AI-powered products. Risk is lower for air-gapped training clusters but HIGH for any customer-facing ML inference service running affected versions.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
tensorflow	pip	—	No patch
195.0K OpenSSF 7.2 3.7K dependents Pushed today 4% patched ~1372d to patch Full package profile →

Do you use tensorflow? You're affected.

Severity & Risk

CVSS 3.1

7.5 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

Attack Surface

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

Recommended Action

5 steps

Patch: Upgrade to TensorFlow 2.10.0, 2.9.1, 2.8.1, or 2.7.2 (commit cf70b79d).
Short-term: Place TensorFlow Serving behind an authenticated API gateway; reject unauthenticated requests at WAF/load balancer.
Input validation: Add shape validation middleware that enforces expected tensor ranks before ops execute.
Detection: Alert on abnormal TF Serving process restarts (SIGABRT/CHECK failure signature in logs).
Blast radius: Ensure inference services run in isolated containers with auto-restart policies so a crash does not cascade to other services.

Classification

DoS Framework Inference AML.T0029 - Denial of AI Service AML.T0040 - AI Model Inference API Access AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI system operation and monitoring

NIST AI RMF

MANAGE 2.4 - Residual risks are monitored and managed MAP 5.1 - Likelihood and magnitude of impacts are assessed

Frequently Asked Questions

What is CVE-2022-35993?

Any TensorFlow deployment (2.7.x–2.9.x) that processes externally-supplied tensor inputs—including ML inference APIs, model serving endpoints, and training pipelines—is vulnerable to remote crash with no authentication required. Patch immediately to 2.10.0, 2.9.1, 2.8.1, or 2.7.2. If patching is delayed, block unauthenticated access to TensorFlow Serving endpoints at the network perimeter.

Is CVE-2022-35993 actively exploited?

No confirmed active exploitation of CVE-2022-35993 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-35993?

1. Patch: Upgrade to TensorFlow 2.10.0, 2.9.1, 2.8.1, or 2.7.2 (commit cf70b79d). 2. Short-term: Place TensorFlow Serving behind an authenticated API gateway; reject unauthenticated requests at WAF/load balancer. 3. Input validation: Add shape validation middleware that enforces expected tensor ranks before ops execute. 4. Detection: Alert on abnormal TF Serving process restarts (SIGABRT/CHECK failure signature in logs). 5. Blast radius: Ensure inference services run in isolated containers with auto-restart policies so a crash does not cascade to other services.

What systems are affected by CVE-2022-35993?

This vulnerability affects the following AI/ML architecture patterns: model serving, inference APIs, training pipelines, NLP pipelines, recommendation systems.

What is the CVSS score for CVE-2022-35993?

CVE-2022-35993 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.06%.

Technical Details

NVD Description

TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_shape` that is not a 1D tensor, it gives a `CHECK` fails that can be used to trigger a denial of service attack. We have patched the issue in GitHub commit cf70b79d2662c0d3c6af74583641e345fc939467. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Exploitation Scenario

An adversary targeting an AI-powered product (e.g., a recommendation engine or NLP API backed by TensorFlow Serving) identifies the service version via banner grabbing or error responses. They craft a gRPC or REST inference request for a model endpoint that internally invokes `SetSize`, supplying a 2D tensor where `set_shape` expects a 1D tensor. The CHECK assertion in `set_size_op.cc` fires, killing the serving process. The attacker repeats at a low rate (one malformed request suffices per restart) to maintain a persistent outage. With no authentication required, this is achievable from any internet host.