CVE-2022-36013 — HIGH (CVSS 7.5) AI Security Vulnerability

CISO Take

A remotely exploitable null pointer dereference in TensorFlow's MLIR GraphDef importer allows unauthenticated attackers to crash any TF serving endpoint that accepts GraphDef input, causing denial of service. No authentication or user interaction required. Patch immediately to TF 2.10.0, 2.9.1, 2.8.1, or 2.7.2; no workaround exists.

Risk Assessment

High severity (CVSS 7.5) but limited to availability impact only — no data exfiltration or code execution risk. Exploitability is trivial: network-accessible, zero privileges, zero user interaction. Real-world risk is highest for organizations exposing TensorFlow Serving or model import APIs over a network boundary. Not in CISA KEV and no public exploit code observed, but the barrier to exploitation is very low given the AV:N/PR:N/UI:N profile.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
tensorflow	pip	—	No patch
195.0K OpenSSF 7.2 3.7K dependents Pushed today 4% patched ~1372d to patch Full package profile →

Do you use tensorflow? You're affected.

Severity & Risk

CVSS 3.1

7.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

Attack Surface

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

Recommended Action

5 steps

Upgrade to TensorFlow 2.10.0, 2.9.1 (2.9.x), 2.8.1 (2.8.x), or 2.7.2 (2.7.x).
No official workaround exists per vendor advisory.
As compensating control, place an API gateway or input validation layer in front of any TF Serving endpoint to reject GraphDef/NodeDef inputs with missing op names before they reach the importer.
Restrict network access to TF Serving endpoints to trusted internal services only.
Implement process restart automation (e.g., systemd watchdog, Kubernetes liveness probe) to minimize downtime if crash occurs before patching.

Classification

DoS Framework Inference AML.T0010.001 - AI Software AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

8.4 - AI system operation

NIST AI RMF

MANAGE-2.2 - Mechanisms to sustain trustworthy AI

OWASP LLM Top 10

LLM04:2025 - Model Denial of Service

Frequently Asked Questions

What is CVE-2022-36013?

A remotely exploitable null pointer dereference in TensorFlow's MLIR GraphDef importer allows unauthenticated attackers to crash any TF serving endpoint that accepts GraphDef input, causing denial of service. No authentication or user interaction required. Patch immediately to TF 2.10.0, 2.9.1, 2.8.1, or 2.7.2; no workaround exists.

Is CVE-2022-36013 actively exploited?

No confirmed active exploitation of CVE-2022-36013 has been reported, but organizations should still patch proactively.

How to fix CVE-2022-36013?

1. Upgrade to TensorFlow 2.10.0, 2.9.1 (2.9.x), 2.8.1 (2.8.x), or 2.7.2 (2.7.x). 2. No official workaround exists per vendor advisory. 3. As compensating control, place an API gateway or input validation layer in front of any TF Serving endpoint to reject GraphDef/NodeDef inputs with missing op names before they reach the importer. 4. Restrict network access to TF Serving endpoints to trusted internal services only. 5. Implement process restart automation (e.g., systemd watchdog, Kubernetes liveness probe) to minimize downtime if crash occurs before patching.

What systems are affected by CVE-2022-36013?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, ML infrastructure APIs.

What is the CVSS score for CVE-2022-36013?

CVE-2022-36013 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.22%.

Technical Details

NVD Description

TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name, it crashes. We have patched the issue in GitHub commit a0f0b9a21c9270930457095092f558fbad4c03e5. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.

Exploitation Scenario

An adversary identifies a TensorFlow Serving instance or an ML pipeline API that accepts GraphDef input (e.g., a model conversion service or a serving endpoint accepting raw graphs). The attacker crafts a minimal GraphDef containing a NodeDef with an empty or missing op name field — trivially constructed with protobuf tooling. Submitting this over the network triggers the null pointer dereference in mlir::tfg::GraphDefImporter::ConvertNodeDef, crashing the TF process immediately. In a Kubernetes-based ML serving environment, this could be looped to keep inference pods in a crash loop, effectively taking down the inference tier for the duration of the attack.