Skip to content
OpenAdvisories
High · 8.1 Public exploit CVE-2022-21728 BIT-tensorflow-2022-21728EUVD-2022-0291GHSA-6gmv-pjp9-p8w8PYSEC-2022-107PYSEC-2022-52PYSEC-2026-3121

Out of bounds read in Tensorflow

Published Feb 3, 2022 · Updated May 5, 2025 · Assigned by GitHub_M

Package: tensorflow Package: tensorflow-cpu Package: tensorflow-gpu Ecosystem: PyPI

Description

Tensorflow is an Open Source Machine Learning Framework. The implementation of shape inference for `ReverseSequence` does not fully validate the value of `batch_dim` and can result in a heap OOB read. There is a check to make sure the value of `batch_dim` does not go over the rank of the input, but there is no check for negative values. Negative dimensions are allowed in some cases to mimic Python's negative indexing (i.e., indexing from the end of the array), however if the value is too negative then the implementation of `Dim` would access elements before the start of an array. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tensorflow < 2.5.3 2.5.3 GHSA-6gmv-pjp9-p8w8
PyPI tensorflow >= 2.6.0, < 2.6.3 2.6.3 GHSA-6gmv-pjp9-p8w8
PyPI tensorflow >= 2.7.0, < 2.7.1 2.7.1 GHSA-6gmv-pjp9-p8w8
PyPI tensorflow < 2.5.3 · >= 2.6.0, < 2.6.3 · >= 2.7.0, < 2.7.1 2.5.3, 2.6.3, 2.7.1 PYSEC-2026-3121
PyPI tensorflow-cpu < 2.5.3 2.5.3 GHSA-6gmv-pjp9-p8w8
PyPI tensorflow-cpu >= 2.6.0, < 2.6.3 2.6.3 GHSA-6gmv-pjp9-p8w8
PyPI tensorflow-cpu >= 2.7.0, < 2.7.1 2.7.1 GHSA-6gmv-pjp9-p8w8
PyPI tensorflow-cpu < 2.5.3 · >= 2.6.0, < 2.6.3 2.5.3, 2.6.3 PYSEC-2022-52
PyPI tensorflow-gpu < 2.5.3 2.5.3 GHSA-6gmv-pjp9-p8w8
PyPI tensorflow-gpu >= 2.6.0, < 2.6.3 2.6.3 GHSA-6gmv-pjp9-p8w8
PyPI tensorflow-gpu >= 2.7.0, < 2.7.1 2.7.1 GHSA-6gmv-pjp9-p8w8
PyPI tensorflow-gpu < 2.5.3 · >= 2.6.0, < 2.6.3 2.5.3, 2.6.3 PYSEC-2022-107

References