CVE-2022-29210: TensorFlow CPU Heap Buffer Overflow Due to Incorrect Hash Function
Summary
CVE-2022-29210: Heap buffer overflow due to incorrect hash function in TensorFlow. Affects tensorflow-cpu versions >= 2.8.0, < 2.8.1. Fixed in 2.8.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2022-29210 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an open-source machine learning library developed by Google, widely used for various applications in deep learning and artificial intelligence. It provides a flexible ecosystem of tools, libraries, and community resources that allows researchers and developers to build and deploy machine learning applications. The library is designed to facilitate the development of complex models while ensuring performance and scalability. However, like any software, TensorFlow is susceptible to vulnerabilities that can impact its functionality and security.
Vulnerability Detail
The vulnerability arises from a heap buffer overflow caused by an incorrect hash function in the TensorKey implementation. The hash function relies on an estimated number of allocated bytes for tensors, which is not a reliable metric for hashing constant values such as integers. This flaw can lead to access violations and potential crashes, as the function attempts to access memory beyond the allocated buffer. The issue is exacerbated by the fact that the hash function does not account for the actual contiguous memory layout of the tensor data, leading to undefined behavior and security risks.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow-cpu==2.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds recommended for this vulnerability other than updating to the patched version of TensorFlow. It is advisable to monitor the application for any unusual behavior until the update is applied.
Conclusion
The CVE-2022-29210 vulnerability in TensorFlow CPU poses a significant risk due to a heap buffer overflow caused by an incorrect hash function. Users are encouraged to update to version 2.8.1 or later to mitigate this risk. Regular monitoring and timely updates are essential for maintaining the security of applications using TensorFlow.
See every vulnerability recorded for tensorflow-cpu →
FAQ
CVE-2022-29210 is a vulnerability in TensorFlow that results in a heap buffer overflow due to an incorrect hash function used in the TensorKey implementation.
This vulnerability can lead to access violations, crashes, and potential security risks due to improper memory handling in the TensorKey hash function.
The affected versions are TensorFlow 2.8.0 and earlier. The issue has been fixed in version 2.8.1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 5.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
