CVE-2023-27506: TensorFlow buffer overflow enables

CISO Take

Intel's optimized TensorFlow distribution (pre-2.12) has a buffer restriction flaw enabling local privilege escalation with low skill required. Any shared ML compute environment—Jupyter hubs, Ray clusters, Slurm HPC nodes—is at risk when multiple users share the same host. Patch to Intel Optimization for TensorFlow 2.12+ immediately and isolate ML workloads into separate containers.

What is the risk?

CVSS 7.8 High with low attack complexity and no user interaction required makes this straightforward to exploit given local access. In enterprise ML environments, local access is routinely granted to data scientists and ML engineers on shared GPU/CPU clusters running Intel Xeon infrastructure. Not in CISA KEV and no public exploits confirmed, but the C:H/I:H/A:H impact triad on shared multi-tenant ML nodes warrants urgent remediation—one compromised ML engineer account can become root.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
TensorFlow	pip	—	No patch
195.8K OpenSSF 7.1 3.7K dependents Pushed 3d ago 4% patched ~1372d to patch Full package profile →

Do you use TensorFlow? You're affected.

How severe is it?

CVSS 3.1

7.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 5% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Local

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

5 steps

Patch: Update Intel Optimization for TensorFlow to 2.12+ immediately—run 'pip list | grep intel-tensorflow' across all ML nodes to identify exposure.
Isolate: Containerize ML workloads (Docker/Kubernetes) so privilege escalation cannot cross tenant boundaries.
Least privilege: Restrict local shell access to ML training nodes; use SSH bastion with MFA.
Detect: Monitor for unexpected setuid/sudo usage and anomalous process ownership changes on ML infrastructure.
Audit: Review Intel SA-00840 advisory for any additional mitigations specific to your hardware configuration.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Framework Training Data AML.T0010.001 - AI Software AML.T0037 - Data from Local System AML.T0106 - Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.8.3 - Information security for AI systems

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place and applied to sustain the value of deployed AI systems and to manage risks over the AI system lifecycle

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2023-27506?

Intel's optimized TensorFlow distribution (pre-2.12) has a buffer restriction flaw enabling local privilege escalation with low skill required. Any shared ML compute environment—Jupyter hubs, Ray clusters, Slurm HPC nodes—is at risk when multiple users share the same host. Patch to Intel Optimization for TensorFlow 2.12+ immediately and isolate ML workloads into separate containers.

Is CVE-2023-27506 actively exploited?

No confirmed active exploitation of CVE-2023-27506 has been reported, but organizations should still patch proactively.

How to fix CVE-2023-27506?

1. Patch: Update Intel Optimization for TensorFlow to 2.12+ immediately—run 'pip list | grep intel-tensorflow' across all ML nodes to identify exposure. 2. Isolate: Containerize ML workloads (Docker/Kubernetes) so privilege escalation cannot cross tenant boundaries. 3. Least privilege: Restrict local shell access to ML training nodes; use SSH bastion with MFA. 4. Detect: Monitor for unexpected setuid/sudo usage and anomalous process ownership changes on ML infrastructure. 5. Audit: Review Intel SA-00840 advisory for any additional mitigations specific to your hardware configuration.

What systems are affected by CVE-2023-27506?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, shared ML compute clusters, MLOps platforms, model serving.

What is the CVSS score for CVE-2023-27506?

CVE-2023-27506 has a CVSS v3.1 base score of 7.8 (HIGH). The EPSS exploitation probability is 0.15%.

What is the AI security impact?

Affected AI Architectures

training pipelinesshared ML compute clustersMLOps platformsmodel serving

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0037 Data from Local System

AML.T0106 Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.8.3

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

Improper buffer restrictions in the Intel(R) Optimization for Tensorflow software before version 2.12 may allow an authenticated user to potentially enable escalation of privilege via local access.

Exploitation Scenario

An authenticated data scientist on a shared Jupyter notebook server crafts a malicious TensorFlow workload that triggers the buffer restriction flaw in Intel's optimized TF runtime. By exploiting CWE-119 (out-of-bounds memory write), they overwrite adjacent memory structures to execute code as root. From root, they exfiltrate competing teams' proprietary model weights, training datasets containing PII, and environment variables holding API keys for cloud services—all without triggering typical security controls since the initial access was fully legitimate.

Weaknesses (CWE)

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Primary CWE-92 DEPRECATED: Improper Sanitization of Custom Special Characters

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.