CVE-2022-21735: Division by zero in Tensorflow
Summary
CVE-2022-21735: Division by zero in Tensorflow. Affects tensorflow across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
>= 2.7.0, < 2.7.1
Fixed in 2.5.3, 2.6.3 or 2.7.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow-gpu · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-21735 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tensorflow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. Tensorflow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in Tensorflow that can lead to a division by zero error, potentially causing a crash in the Tensorflow process.
Vulnerability Detail
The vulnerability in Tensorflow is related to the implementation of the FractionalMaxPool function. By providing specific input values, an attacker can trigger a division by zero error in the function, leading to a crash in the Tensorflow process. This vulnerability can be exploited by an attacker with the ability to execute arbitrary code using Tensorflow. The impact of this vulnerability can range from denial of service to potential code execution.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow==2.6.3" -
>= 2.7.0, < 2.7.12.7.1pip install --upgrade "tensorflow==2.7.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, you can avoid using the FractionalMaxPool function or ensure that the input values do not trigger the division by zero error. This can be achieved by carefully validating and sanitizing the input values before passing them to the function. Here is an example of how to validate the input values in Python:
import tensorflow as tf
import numpy as np
value = np.array([[[[1, 4, 2, 3]]]], dtype=np.int64)
if np.any(value == 0):
raise ValueError('Input values should not be zero')
# Call the FractionalMaxPool function with validated input
# ... (rest of the code)
By performing this validation, you can prevent the division by zero error and mitigate the vulnerability.
Conclusion
In conclusion, the vulnerability in Tensorflow can be mitigated by updating to the latest patched version or by validating the input values to prevent the division by zero error. It is important to stay updated with the latest security patches and follow best practices for secure coding when using Tensorflow. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
Tensorflow is an open-source machine learning framework developed by Google. It provides tools and resources for building and deploying machine learning models.
The vulnerability can lead to a division by zero error in Tensorflow, potentially causing a crash in the Tensorflow process. The impact can range from denial of service to potential code execution.
To fix this vulnerability, it is recommended to update to the latest patched version of Tensorflow (2.8.0 or later).
Yes, you can avoid using the FractionalMaxPool function or validate the input values to prevent the division by zero error.
You can find more information about this vulnerability in the TensorFlow GitHub repository and the associated security guide.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
