Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

TensorFlow may crash on very large numeric input

CVE-2022-35940 · published 4 years ago
Summary

TensorFlow's ragged range function can stop the entire program if it receives an extremely large number. The problem is fixed in TensorFlow version 2.10 and will also be back‑ported to versions 2.9.1, 2.8.1, and 2.7.2. Upgrade to one of these patched releases to avoid the crash.

What to do
  • Update google inc. tensorflow to version 2.7.2.
  • Update google inc. tensorflow to version 2.8.1.
  • Update google inc. tensorflow to version 2.9.1.
  • Update google tensorflow-gpu to version 2.7.2.
  • Update google tensorflow-gpu to version 2.8.1.
  • Update google tensorflow-gpu to version 2.9.1.
  • Update google inc. tensorflow-cpu to version 2.7.2.
  • Update google inc. tensorflow-cpu to version 2.8.1.
  • Update google inc. tensorflow-cpu to version 2.9.1.
Affected software
Ecosystem VendorProductAffected versions
pip google inc. tensorflow < 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
Fix: upgrade to 2.7.2
pip google tensorflow-gpu < 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
Fix: upgrade to 2.7.2
pip google inc. tensorflow-cpu < 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
Fix: upgrade to 2.7.2
– google tensorflow >= 2.7.0, < 2.7.2
>= 2.8.0, < 2.8.1
>= 2.9.0, < 2.9.1
2.10
cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
Original advisory text
Int overflow in `RaggedRangeOp` in Tensoflow
TensorFlow is an open source platform for machine learning. The `RaggedRangOp` function takes an argument `limits` that is eventually used to construct a `TensorShape` as an `int64`. If `limits` is a very large float, it can overflow when converted to an `int64`. This triggers an `InvalidArgument` but also throws an abort signal that crashes the program. We have patched the issue in GitHub commit 37cefa91bee4eace55715eeef43720b958a01192. The fix will be included in TensorFlow 2.10.0. We will also cherrypick this commit on TensorFlow 2.9.1, TensorFlow 2.8.1, and TensorFlow 2.7.2, as these are also affected and still in supported range. There are no known workarounds for this issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-190Integer Overflow
Timeline
Published16 Sep 2022
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-x989-q2pq-4q5x · GHSA
CVE-2022-35940 · NVD
CVE-2022-35940 · OSV
Track software like this
Free during beta