CVE-2022-21740: Heap Overflow in TensorFlow-GPU
Summary
CVE-2022-21740: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 4 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< 2b7100d6cdff36aa21010a82269bc05a6d1cc74a
< adbbabdb0d3abb3cdeac69e38a96de1d678b24b3
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-21740 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and deploying machine learning models. It provides a comprehensive ecosystem of tools, libraries, and resources for building and training neural networks. TensorFlow-GPU is a variant of TensorFlow that leverages GPU acceleration for faster computation. This vulnerability affects the TensorFlow-GPU package.
Vulnerability Detail
The vulnerability, identified as CVE-2022-21740, is a heap overflow in the implementation of SparseCountSparseOutput in TensorFlow-GPU. This vulnerability allows an attacker to overwrite adjacent memory regions, potentially leading to arbitrary code execution or a system crash. The issue has been addressed in TensorFlow versions 2.8.0, 2.7.1, 2.6.3, and 2.5.3. It is recommended to update to the latest patched version to mitigate the risk.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-gpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-gpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched versions mentioned above to address the issue.
Conclusion
In conclusion, the heap overflow vulnerability in TensorFlow-GPU (CVE-2022-21740) poses a risk of arbitrary code execution or system crashes. It is crucial to update to the patched versions (2.8.0, 2.7.1, 2.6.3, or 2.5.3) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow is an open-source machine learning framework used for developing and deploying machine learning models. It provides a wide range of tools and resources for building neural networks.
TensorFlow-GPU is a variant of TensorFlow that utilizes GPU acceleration for faster computation. It is commonly used in scenarios where large-scale machine learning models require significant computational power.
A heap overflow is a type of vulnerability where a program writes data beyond the allocated memory region in the heap. This can lead to memory corruption, potentially allowing an attacker to execute arbitrary code or crash the system.
The heap overflow vulnerability in TensorFlow-GPU can potentially allow an attacker to execute arbitrary code or crash the system. This could lead to unauthorized access, data breaches, or denial-of-service attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
