CVE-2025-55559
📋 TL;DR
A Denial of Service vulnerability exists in TensorFlow v2.18.0 where using 'valid' padding in tf.keras.layers.Conv2D operations can cause resource exhaustion and service disruption. This affects any system running vulnerable TensorFlow versions for machine learning inference or training. The vulnerability is triggered through normal API usage rather than malicious input.
💻 Affected Systems
- TensorFlow
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of TensorFlow-based applications, causing extended downtime for ML inference services or training pipelines.
Likely Case
Intermittent service degradation or crashes when Conv2D layers with 'valid' padding process certain input shapes, requiring application restarts.
If Mitigated
Minimal impact with proper monitoring and rapid restart capabilities, though some performance degradation may occur.
🎯 Exploit Status
Exploitation requires ability to trigger Conv2D operations with specific parameters. Public GitHub gist demonstrates the issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: TensorFlow 2.18.1 or later
Vendor Advisory: https://github.com/tensorflow/tensorflow/issues/84205
Restart Required: Yes
Instructions:
1. Update TensorFlow: pip install --upgrade tensorflow 2. Verify version: python -c 'import tensorflow as tf; print(tf.__version__)' 3. Restart all TensorFlow services and applications.
🔧 Temporary Workarounds
Avoid 'valid' padding in Conv2D
allTemporarily change padding parameter from 'valid' to 'same' in all tf.keras.layers.Conv2D instances
# In Python code, replace: tf.keras.layers.Conv2D(..., padding='valid')
# With: tf.keras.layers.Conv2D(..., padding='same')
🧯 If You Can't Patch
- Implement circuit breakers and resource limits on TensorFlow processes
- Deploy redundant instances with load balancing to maintain service during restarts
🔍 How to Verify
Check if Vulnerable:
Check TensorFlow version and inspect code for Conv2D layers with padding='valid'Check Version:
python -c 'import tensorflow as tf; print(tf.__version__)'Verify Fix Applied:
Confirm TensorFlow version is 2.18.1+ and test Conv2D operations with 'valid' padding📡 Detection & Monitoring
Log Indicators:
- TensorFlow process crashes
- Memory exhaustion warnings
- Unusual Conv2D operation failures
Network Indicators:
- Sudden drop in ML inference API responses
- Increased error rates in TensorFlow services
SIEM Query:
process.name:tensorflow AND (event.type:crash OR memory.usage>90%)