CVE-2022-21738: TensorFlow GPU - Integer Overflow in SparseCountSparseOutput
Summary
CVE-2022-21738: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< 6f4d3e8139ec724dbbcb40505891c81dd1052c4a
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-21738 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for building and training various types of neural networks. It provides a comprehensive set of tools and libraries for efficient computation and data manipulation. TensorFlow GPU is a specific package that enables GPU acceleration for TensorFlow models, allowing for faster training and inference.
Vulnerability Detail
The vulnerability (CVE-2022-21738) in TensorFlow GPU arises from an integer overflow issue in the implementation of SparseCountSparseOutput. This flaw can lead to a crash of the TensorFlow process due to the resulting integer overflow being used in a memory allocation. An attacker could potentially exploit this vulnerability to cause a denial-of-service (DoS) attack or execute arbitrary code on the affected system. The vulnerability affects versions 0 and above of the TensorFlow GPU package.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-gpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-gpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability. Users are advised to apply the recommended fix by updating to the patched versions of TensorFlow GPU.
Conclusion
The vulnerability in TensorFlow GPU (CVE-2022-21738) poses a risk of crashing the TensorFlow process and potentially enabling attackers to execute arbitrary code. It is crucial for users of TensorFlow GPU to update to the latest patched version (2.8.0) or one of the backported versions (2.7.1, 2.6.3, or 2.5.3) to mitigate this vulnerability. For further assistance or support in addressing this vulnerability, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a package that enables GPU acceleration for TensorFlow models, allowing for faster training and inference by leveraging the computational power of GPUs.
The vulnerability can lead to a crash of the TensorFlow process, potentially causing a denial-of-service (DoS) attack or enabling an attacker to execute arbitrary code on the affected system.
The vulnerability affects all versions of TensorFlow GPU starting from version 0.
To fix this vulnerability, it is recommended to upgrade to the latest patched version of TensorFlow GPU (2.8.0) once it becomes available. Alternatively, users on older versions can update to TensorFlow GPU versions 2.7.1, 2.6.3, or 2.5.3.
For more information about this vulnerability, you can refer to the official TensorFlow project's advisory database or the CVE entry (CVE-2022-21738).
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
