CVE-2022-21741: Division by Zero Vulnerability in tensorflow-gpu
Summary
CVE-2022-21741: Tensorflow is an Open Source Machine Learning Framework. Affects tensorflow-gpu across 3 version ranges.
< 2.5.3
>= 2.6.0, < 2.6.3
< e5b0eec199c2d03de54fd6a7fd9275692218e2bc
Fixed in 2.5.3 or 2.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
The same CVE-2022-21741 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Tensorflow is an open-source machine learning framework that provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. It is widely used in various domains, including computer vision, natural language processing, and deep learning. The tensorflow-gpu package is a PyPI package that enables GPU acceleration for TensorFlow. It allows users to leverage the power of GPUs to accelerate their machine learning workflows.
Vulnerability Detail
This vulnerability in tensorflow-gpu allows an attacker to craft a TFLite model that triggers a division by zero in the implementation of depthwise convolutions. The parameters of the convolution, which can be controlled by the user, are used in a division operation to determine the size of the padding before applying the convolution. However, there is no check to ensure that the divisor is strictly positive, leading to a potential division by zero error. An attacker can exploit this vulnerability to cause a denial of service or potentially execute arbitrary code.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.5.32.5.3pip install --upgrade "tensorflow-gpu==2.5.3" -
>= 2.6.0, < 2.6.32.6.3pip install --upgrade "tensorflow-gpu==2.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed versions mentioned above.
Conclusion
The division by zero vulnerability in tensorflow-gpu can be mitigated by upgrading to the fixed versions mentioned above. It is crucial to keep software dependencies up to date to ensure the security and stability of machine learning workflows. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow is an open-source machine learning framework that provides tools and resources for developing and deploying machine learning models.
tensorflow-gpu is a PyPI package that enables GPU acceleration for TensorFlow, allowing users to leverage the power of GPUs for faster machine learning workflows.
TFLite is a file format used by TensorFlow for deploying machine learning models on mobile and embedded devices. It is optimized for resource-constrained environments.
A depthwise convolution is a type of convolutional operation commonly used in deep learning models for processing spatial data, such as images. It applies a separate filter to each input channel and produces a separate output channel for each input channel.
This vulnerability can be exploited by an attacker to cause a denial of service or potentially execute arbitrary code. It is important to upgrade to the fixed versions to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
