CVE-2022-29210: Heap buffer overflow in TensorFlow
Summary
CVE-2022-29210: Heap buffer overflow due to incorrect hash function in TensorFlow. Affects tensorflow versions >= 2.8.0, < 2.8.1. Fixed in 2.8.1. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
The same CVE-2022-29210 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. However, a vulnerability has been discovered in TensorFlow that could lead to a heap buffer overflow.
Vulnerability Detail
The vulnerability in TensorFlow is caused by an incorrect hash function used in the TensorKey class. The hash function incorrectly uses the AllocatedBytes() method, which is an estimate per tensor and is not suitable for hashing constants like int32_t. Additionally, the function tries to access individual tensor bytes through tensor.data() of size AllocatedBytes(), which can lead to ASAN failures. The AllocatedBytes() method includes any pointed-to constructs, such as strings, which results in a non-contiguous buffer. This vulnerability could be exploited to cause a heap buffer overflow, potentially leading to remote code execution or denial of service.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow==2.8.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update to the patched versions of TensorFlow as soon as possible.
Conclusion
The vulnerability in TensorFlow has been identified and patched in versions 2.9.0 and 2.8.1. Users are advised to update their TensorFlow installations to these patched versions to mitigate the risk of a heap buffer overflow. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides tools and resources for building and deploying machine learning models.
A heap buffer overflow occurs when a program writes data beyond the allocated memory buffer in the heap. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code or cause a denial of service.
This vulnerability in TensorFlow could potentially allow an attacker to trigger a heap buffer overflow, leading to remote code execution or denial of service.
To fix this vulnerability, update your TensorFlow installation to version 2.9.0 or 2.8.1, which include the necessary patches to address the issue.
There is no known workaround for this vulnerability. It is recommended to update to the patched versions of TensorFlow.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
