CVE-2022-41891: TensorFlow CPU Segfault Vulnerability in TensorListConcat
Summary
CVE-2022-41891: Segfault in tf.raw_ops.TensorListConcat. Affects tensorflow-cpu across 3 version ranges.
< 2.8.4
>= 2.9.0, < 2.9.3
>= 2.10.0, < 2.10.1
Fixed in 2.8.4, 2.9.3 or 2.10.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-gpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2022-41891 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning library widely used for various applications, including deep learning and neural networks. The 'tensorflow-cpu' package provides CPU support for TensorFlow, enabling users to run machine learning models efficiently on systems without GPU. This package is critical for developers and researchers who rely on TensorFlow for their machine learning tasks. However, it is susceptible to a specific vulnerability that can lead to a segmentation fault, impacting the stability and security of applications using this library.
Vulnerability Detail
The vulnerability arises in the 'tf.raw_ops.TensorListConcat' function when it is provided with an 'element_shape' parameter set to an empty shape (i.e., []). This condition triggers a segmentation fault, which can be exploited to cause a denial of service (DoS) attack. The issue is particularly concerning as it can lead to unexpected application crashes, affecting the availability of services relying on TensorFlow for processing data.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-cpu==2.21.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.8.42.8.4pip install --upgrade "tensorflow-cpu==2.8.4" -
>= 2.9.0, < 2.9.32.9.3pip install --upgrade "tensorflow-cpu==2.9.3" -
>= 2.10.0, < 2.10.12.10.1pip install --upgrade "tensorflow-cpu==2.10.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using 'tf.raw_ops.TensorListConcat' with an empty 'element_shape'. Ensure that the 'element_shape' parameter is set to a valid shape to prevent triggering the segmentation fault. For example, use: 'element_shape=[1]' instead of 'element_shape=[]'.
Conclusion
In summary, CVE-2022-41891 is a significant vulnerability in the TensorFlow CPU package that can lead to application crashes due to a segmentation fault. Users are advised to update their TensorFlow installations to the latest patched versions to mitigate the risk. Additionally, employing workarounds and utilizing tools like Vulert can enhance security and monitoring efforts.
See every vulnerability recorded for tensorflow-cpu →
FAQ
CVE-2022-41891 is a vulnerability in the TensorFlow CPU package that causes a segmentation fault when using the TensorListConcat operation with an empty element shape.
Exploiting this vulnerability can lead to application crashes, resulting in denial of service and impacting the availability of services that depend on TensorFlow.
The vulnerability affects TensorFlow versions prior to 2.8.4, 2.9.3, and 2.10.1. Users should upgrade to these versions or later to mitigate the issue.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score of this vulnerability is 4.8, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-cpu.
