CVE-2022-36015: TensorFlow GPU Integer Overflow Vulnerability in Math Operations
Summary
CVE-2022-36015: TensorFlow vulnerable to integer overflow in math ops. Affects tensorflow-gpu across 3 version ranges.
< 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
Fixed in 2.7.2, 2.8.1 or 2.9.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2022-36015 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning library widely used for building and training machine learning models. It provides a flexible ecosystem of tools, libraries, and community resources that lets researchers and developers create and deploy machine learning applications. The library includes various mathematical operations, which are crucial for model training and inference. However, a vulnerability has been identified in TensorFlow's math operations that can lead to crashes under certain conditions.
Vulnerability Detail
The vulnerability arises in the RangeSize function of TensorFlow's math operations, where it fails to properly handle integer overflow. When the function receives values that exceed the limits of an int64_t type, it can result in a crash. This issue is particularly concerning as it can disrupt applications relying on TensorFlow for critical computations, leading to potential data loss or service interruptions. The specific code segment responsible for this issue does not adequately check for all cases of overflow, which can lead to invalid arguments being processed.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.22.7.2pip install --upgrade "tensorflow-gpu==2.7.2" -
>= 2.8.0, < 2.8.12.8.1pip install --upgrade "tensorflow-gpu==2.8.1" -
>= 2.9.0, < 2.9.12.9.1pip install --upgrade "tensorflow-gpu==2.9.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched versions of TensorFlow as indicated.
Conclusion
The CVE-2022-36015 vulnerability in TensorFlow GPU poses a significant risk due to potential integer overflow in mathematical operations. It is essential to update to the patched versions to ensure the stability and security of applications using TensorFlow. Regular monitoring for vulnerabilities using tools like Vulert can help maintain a secure software environment.
See every vulnerability recorded for tensorflow-gpu →
FAQ
CVE-2022-36015 is a vulnerability in TensorFlow that can cause crashes due to integer overflow in mathematical operations.
If your application uses TensorFlow and processes large numerical ranges, it may crash unexpectedly, leading to potential data loss or service interruptions.
The vulnerability affects TensorFlow versions prior to 2.7.2, 2.8.1, and 2.9.1. Ensure you are using version 2.10.0 or later to avoid this issue.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to prioritize updating TensorFlow to a secure version as soon as possible to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
