Skip to content
OpenAdvisories
Medium · 4.8 CVE-2022-41909 BIT-tensorflow-2022-41909EUVD-2022-7425GHSA-rjx6-v474-2ch9PYSEC-2026-1034PYSEC-2026-3238PYSEC-2026-3368

Segfault in `CompositeTensorVariantToComponents` in Tensorflow

Published Nov 18, 2022 · Updated Apr 22, 2025 · Assigned by GitHub_M

Vendor: TensorFlow Product: TensorFlow Package: tensorflow Package: tensorflow Package: tensorflow-cpu Package: tensorflow-gpu Ecosystem: Azure Linux Ecosystem: PyPI

Description

TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `tf.raw_ops.CompositeTensorVariantToComponents`. We have patched the issue in GitHub commits bf594d08d377dc6a3354d9fdb494b32d45f91971 and 660ce5a89eb6766834bdc303d2ab3902aef99d3d. The fix will be included in TensorFlow 2.11. We will also cherrypick this commit on TensorFlow 2.10.1, 2.9.3, and TensorFlow 2.8.4, as these are also affected and still in supported range.

Affected products

VendorProductAffectedFixed
tensorflow tensorflow >= 2.10.0, < 2.10.1, >= 2.9.0, < 2.9.3, < 2.8.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) tensorflow 2.11.0-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI tensorflow < 2.8.4 2.8.4 GHSA-rjx6-v474-2ch9
PyPI tensorflow >= 2.9.0, < 2.9.3 2.9.3 GHSA-rjx6-v474-2ch9
PyPI tensorflow >= 2.10.0, < 2.10.1 2.10.1 GHSA-rjx6-v474-2ch9
PyPI tensorflow < 2.8.4 · >= 2.9.0, < 2.9.3 · >= 2.10.0, < 2.10.1 2.8.4, 2.9.3, 2.10.1 PYSEC-2026-3238
PyPI tensorflow-cpu < 2.8.4 2.8.4 GHSA-rjx6-v474-2ch9
PyPI tensorflow-cpu >= 2.9.0, < 2.9.3 2.9.3 GHSA-rjx6-v474-2ch9
PyPI tensorflow-cpu >= 2.10.0, < 2.10.1 2.10.1 GHSA-rjx6-v474-2ch9
PyPI tensorflow-cpu < 2.8.4 · >= 2.9.0, < 2.9.3 · >= 2.10.0, < 2.10.1 2.8.4, 2.9.3, 2.10.1 PYSEC-2026-3368
PyPI tensorflow-gpu < 2.8.4 2.8.4 GHSA-rjx6-v474-2ch9
PyPI tensorflow-gpu >= 2.9.0, < 2.9.3 2.9.3 GHSA-rjx6-v474-2ch9
PyPI tensorflow-gpu >= 2.10.0, < 2.10.1 2.10.1 GHSA-rjx6-v474-2ch9
PyPI tensorflow-gpu < 2.8.4 · >= 2.9.0, < 2.9.3 · >= 2.10.0, < 2.10.1 2.8.4, 2.9.3, 2.10.1 PYSEC-2026-1034

References