CVE-2022-21741: Division by Zero Vulnerability in tensorflow-cpu
Summary
CVE-2022-21741: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-cpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< e5b0eec199c2d03de54fd6a7fd9275692218e2bc
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-gpu · PyPI
The same CVE-2022-21741 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tensorflow is an open-source machine learning framework that provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. It is widely used in various domains, including computer vision, natural language processing, and deep learning. The tensorflow-cpu package is a Python package that allows users to utilize TensorFlow on CPUs. It provides the core functionality of TensorFlow without GPU support.
Vulnerability Detail
The vulnerability (CVE-2022-21741) in tensorflow-cpu allows an attacker to exploit a division by zero issue in the implementation of depthwise convolutions. By crafting a TFLite model with user-controlled parameters, an attacker can trigger the division by zero. The parameters of the convolution, which are used within a division operation to determine the size of the padding, can be manipulated to cause the division to occur without any check for a strictly positive divisor. This vulnerability can lead to a denial-of-service (DoS) condition or potentially enable an attacker to execute arbitrary code.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-cpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-cpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can apply input validation and sanitization techniques to ensure that the parameters used in the convolution operation are within the expected range. Additionally, implementing proper error handling and exception handling mechanisms can help prevent the exploitation of this vulnerability.
Conclusion
The division by zero vulnerability in tensorflow-cpu (CVE-2022-21741) can be exploited by crafting a TFLite model with manipulated parameters. Upgrading to the latest version of tensorflow-cpu or applying the provided patches is crucial to mitigate the risk. Input validation, sanitization, and error handling techniques can serve as additional safeguards. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-cpu →
FAQ
TensorFlow is an open-source machine learning framework that provides tools and resources for developing and deploying machine learning models.
tensorflow-cpu is a Python package that allows users to utilize TensorFlow on CPUs, providing the core functionality of TensorFlow without GPU support.
This vulnerability can lead to a division by zero error in the implementation of depthwise convolutions, potentially resulting in a denial-of-service condition or enabling arbitrary code execution.
To fix this vulnerability, it is recommended to upgrade to the latest available version of tensorflow-cpu (2.8.0 or higher) using the package manager or by running 'pip install --upgrade tensorflow-cpu'.
As a workaround, users can implement input validation and sanitization techniques to ensure the parameters used in the convolution operation are within the expected range. Proper error handling and exception handling mechanisms can also help mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
