CVE-2022-29210: TensorFlow GPU Heap Buffer Overflow Vulnerability
Summary
CVE-2022-29210: Heap buffer overflow due to incorrect hash function in TensorFlow. Affects tensorflow-gpu versions >= 2.8.0, < 2.8.1. Fixed in 2.8.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2022-29210 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source platform for machine learning that provides a comprehensive ecosystem for building and deploying machine learning models. TensorFlow GPU is a variant that leverages GPU acceleration for improved performance. The platform is widely used in both research and production environments, making its security critical. This vulnerability affects TensorFlow GPU versions 2.8.0 and earlier, where an incorrect hash function can lead to serious memory management issues.
Vulnerability Detail
The vulnerability arises from the TensorKey hash function, which incorrectly estimates the total allocated bytes for tensors. This poor hash function can lead to heap buffer overflow, as it attempts to access tensor bytes beyond their allocated memory. The issue is particularly severe for constant values, such as int32_t, where the hash function fails to provide a valid representation of the data. This can result in ASAN (AddressSanitizer) failures and potential exploitation, leading to application crashes or arbitrary code execution.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-gpu==2.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the affected versions of TensorFlow GPU (2.8.0 and earlier) until you can upgrade to the patched version. Additionally, consider using alternative methods for tensor management that do not rely on the flawed hash function.
Conclusion
The CVE-2022-29210 vulnerability in TensorFlow GPU poses a significant risk due to heap buffer overflow caused by an incorrect hash function. Users are advised to upgrade to version 2.8.1 or later to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for tensorflow-gpu →
FAQ
CVE-2022-29210 is a vulnerability in TensorFlow GPU that can lead to heap buffer overflow due to an incorrect hash function used in tensor management.
The affected versions are TensorFlow GPU 2.8.0 and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.5, indicating a moderate severity level.
If you cannot upgrade immediately, avoid using the affected versions and consider alternative tensor management methods until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
