CVE-2022-29207: TensorFlow GPU - Undefined Behavior with Invalid Resource Handles
Summary
CVE-2022-29207: Undefined behavior when users supply invalid resource handles. Affects tensorflow-gpu across 3 version ranges.
< 2.6.4
>= 2.7.0, < 2.7.2
>= 2.8.0, < 2.8.1
Fixed in 2.6.4, 2.7.2 or 2.8.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · Bitnami
- tensorflow · PyPI
The same CVE-2022-29207 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an open-source machine learning library widely used for various applications, including deep learning and neural networks. It provides a flexible ecosystem for building and deploying machine learning models. TensorFlow GPU is a variant optimized for performance on NVIDIA GPUs, allowing for faster computation. However, it has been found to have a vulnerability that arises when users supply invalid resource handles, particularly in eager execution mode.
Vulnerability Detail
The vulnerability occurs when TensorFlow operations misbehave in eager mode due to invalid resource handles being supplied. For instance, calling 'tf.raw_ops.QueueIsClosedV2(handle=[])' or 'tf.summary.flush(writer=())' with an empty resource handle leads to undefined behavior, as it binds a reference to a null pointer within the TensorFlow codebase. This can result in crashes or unpredictable behavior, posing a significant risk to applications relying on TensorFlow for critical tasks.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.6.42.6.4pip install --upgrade "tensorflow-gpu==2.6.4" -
>= 2.7.0, < 2.7.22.7.2pip install --upgrade "tensorflow-gpu==2.7.2" -
>= 2.8.0, < 2.8.12.8.1pip install --upgrade "tensorflow-gpu==2.8.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, ensure that valid resource handles are always provided to TensorFlow operations. Avoid passing empty lists or tuples as handles to prevent triggering the undefined behavior. For example, instead of using 'handle=[]', ensure that a valid handle is passed.
Conclusion
CVE-2022-29207 is a significant vulnerability in TensorFlow GPU that can lead to undefined behavior when invalid resource handles are supplied. Users are encouraged to update to the patched versions to mitigate risks and ensure the stability of their applications.
See every vulnerability recorded for tensorflow-gpu →
FAQ
CVE-2022-29207 is a vulnerability in TensorFlow GPU that arises from undefined behavior when invalid resource handles are supplied in eager execution mode.
This vulnerability can lead to crashes or unpredictable behavior in TensorFlow applications that rely on invalid resource handles, potentially compromising the integrity of the application.
The vulnerability affects TensorFlow GPU versions prior to 2.6.4, 2.7.2, and 2.8.1. Users are advised to upgrade to these patched versions or later.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner without needing to sign up.
The CVSS score of this vulnerability is 5.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
