CVE-2022-21739: TensorFlow CPU - QuantizedMaxPool Null Pointer Reference
Summary
CVE-2022-21739: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-cpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< 53b0dd6dc5957652f35964af16b892ec9af4a559
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2022-21739 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive set of tools and libraries for building and training neural networks. TensorFlow CPU is a specific package that focuses on providing CPU support for TensorFlow. It allows users to utilize TensorFlow's capabilities on systems without GPU acceleration.
Vulnerability Detail
The vulnerability (CVE-2022-21739) affects the implementation of QuantizedMaxPool in TensorFlow CPU. This vulnerability arises due to an undefined behavior where user-controlled inputs can trigger a reference binding to a null pointer. An attacker can exploit this flaw by providing specially crafted inputs, leading to a null pointer dereference. This could potentially result in a crash or enable an attacker to execute arbitrary code with the privileges of the TensorFlow process. The vulnerability has been assigned a CVSS score of X.X, indicating its severity.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-cpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-cpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is recommended to update to the fixed versions of TensorFlow CPU as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability (CVE-2022-21739) in TensorFlow CPU's QuantizedMaxPool has been addressed in TensorFlow 2.8.0 and backported to earlier versions. Users are advised to update their TensorFlow CPU package to one of the fixed versions to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open-source machine learning framework used for developing and deploying machine learning models. It provides a comprehensive set of tools and libraries for building and training neural networks.
TensorFlow CPU is a specific package that focuses on providing CPU support for TensorFlow. It allows users to utilize TensorFlow's capabilities on systems without GPU acceleration.
The vulnerability allows an attacker to trigger a null pointer dereference in TensorFlow CPU, potentially leading to a crash or arbitrary code execution with the privileges of the TensorFlow process.
To fix this vulnerability, update your TensorFlow CPU package to one of the fixed versions (2.8.0, 2.7.1, 2.6.3, or 2.5.3) by running the command: pip install --upgrade tensorflow-cpu==<version>.
No specific workaround has been provided for this vulnerability. It is recommended to update to the fixed versions of TensorFlow CPU.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
