CVE-2022-21731: Denial of Service Vulnerability in tensorflow-gpu
Summary
CVE-2022-21731: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< 08d7b00c0a5a20926363849f611729f53f3ec022
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-21731 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tensorflow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive set of tools and libraries for building and training neural networks. The tensorflow-gpu package is a variant of TensorFlow that leverages GPU acceleration for faster computation. It is commonly used in scenarios where large-scale data processing and complex model training are required.
Vulnerability Detail
The vulnerability (CVE-2022-21731) in tensorflow-gpu arises from a type confusion issue in the implementation of shape inference for the ConcatV2 operation. By exploiting this vulnerability, an attacker can trigger a denial of service attack leading to a segmentation fault. The vulnerability stems from a flaw in the validation of the axis argument, which is translated into concat_dim in the ConcatShapeHelper helper function. Due to a mismatch between the 32-bit min_rank value and the negative axis value, the error check is bypassed, allowing the attack to occur. This vulnerability can be exploited remotely without authentication, potentially impacting the availability of TensorFlow-based machine learning systems.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-gpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-gpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid the vulnerability by refraining from using the ConcatV2 operation with specific combinations of axis and rank values that trigger the type confusion. Alternatively, users can switch to the CPU version of TensorFlow (tensorflow package) until the fixed version of tensorflow-gpu is available.
Conclusion
The vulnerability (CVE-2022-21731) in tensorflow-gpu poses a risk of denial of service attacks through a type confusion issue in the ConcatV2 operation. Users are advised to update their tensorflow-gpu package to one of the fixed versions or apply the provided workarounds. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow is an open-source machine learning framework used for building and training neural networks. It provides a wide range of tools and libraries for developing machine learning models.
tensorflow-gpu is a variant of TensorFlow that utilizes GPU acceleration for faster computation. It is commonly used in scenarios where large-scale data processing and complex model training are required.
The vulnerability (CVE-2022-21731) allows an attacker to trigger a denial of service attack by exploiting a type confusion issue in the ConcatV2 operation. This can lead to a segmentation fault and potentially impact the availability of TensorFlow-based machine learning systems.
To fix the vulnerability, users should update their tensorflow-gpu package to one of the fixed versions: TensorFlow 2.8.0, TensorFlow 2.7.1, TensorFlow 2.6.3, or TensorFlow 2.5.3. This can be done by running the command: pip install --upgrade tensorflow-gpu==<fixed_version>.
As a temporary workaround, users can avoid the vulnerability by not using the ConcatV2 operation with specific combinations of axis and rank values that trigger the type confusion. Alternatively, users can switch to the CPU version of TensorFlow (tensorflow package) until the fixed version of tensorflow-gpu is available.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
