TensorFlowGHSA-xrp2-fhq4-4q3w

Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow

CVE-2022-29211 · Published May 24, 2022 · updated Jul 13, 2026

Medium5.5

Fix: upgrade to 2.6.4 or later (3 fixed versions below)

Impact

The implementation of [tf.histogram_fixed_width](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/histogram_op.cc) is vulnerable to a crash when the values array contain NaN elements:

```python

import tensorflow as tf

import numpy as np

tf.histogram_fixed_width(values=np.nan, value_range=[1,2])

The [implementation](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/histogram_op.cc#L35-L74) assumes that all floating point operations are defined and then converts a floating point result to an integer index:

```cc

index_to_bin.device(d) =

((values.cwiseMax(value_range(0)) - values.constant(value_range(0)))

.template cast<double>() /

step)

.cwiseMin(nbins_minus_1)

.template cast<int32>();

If values contains NaN then the result of the division is still NaN and the cast to int32 would result in a crash.

This only occurs on the CPU implementation.

Patches

We have patched the issue in GitHub commit [e57fd691c7b0fd00ea3bfe43444f30c1969748b5](https://github.com/tensorflow/tensorflow/commit/e57fd691c7b0fd00ea3bfe43444f30c1969748b5).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also...

Affected versions

Package	Affected	Fixed in
tensorflow PyPI	< 2.6.4	2.6.4
	>= 2.7.0, < 2.7.2	2.7.2
	>= 2.8.0, < 2.8.1	2.8.1

Details and references

### Impact The implementation of [`tf.histogram_fixed_width`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/histogram_op.cc) is vulnerable to a crash when the values array contain `NaN` elements: ```python import tensorflow as tf import numpy as np tf.histogram_fixed_width(values=np.nan, value_range=[1,2]) ``` The [implementation](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/histogram_op.cc#L35-L74) assumes that all floating point operations are defined and then converts a floating point result to an integer index: ```cc index_to_bin.device(d) = ((values.cwiseMax(value_range(0)) - values.constant(value_range(0))) .template cast<double>() / step) .cwiseMin(nbins_minus_1) .template cast<int32>(); ``` If `values` contains `NaN` then the result of the division is still `NaN` and the cast to `int32` would result in a crash. This only occurs on the CPU implementation. ### Patches We have patched the issue in GitHub commit [e57fd691c7b0fd00ea3bfe43444f30c1969748b5](https://github.com/tensorflow/tensorflow/commit/e57fd691c7b0fd00ea3bfe43444f30c1969748b5). The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range. ### For more information Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions. ### Attribution This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/45770).

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-20
Also known as: BIT-tensorflow-2022-29211, CVE-2022-29211, PYSEC-2026-1048, PYSEC-2026-3260, PYSEC-2026-3382

More TensorFlow advisories

All TensorFlow

High 7.8May 24, 2022

Code injection in `saved_model_cli` in TensorFlowCVE-2022-29216fixed in 2.6.4 +2 Medium 5.5May 24, 2022

Incomplete validation in signal ops leads to crashes in TensorFlowCVE-2022-29213fixed in 2.6.4 +2 Medium 5.5May 24, 2022

Core dump when loading TFLite models with quantization in TensorFlowCVE-2022-29212fixed in 2.6.4 +2 Medium 5.5May 24, 2022

Heap buffer overflow due to incorrect hash function in TensorFlowCVE-2022-29210fixed in 2.8.1 Medium 5.5May 24, 2022

Type confusion leading to `CHECK`-failure based denial of service in TensorFlowCVE-2022-29209fixed in 2.6.4 +2 High 7.1May 24, 2022

Segfault and OOB write due to incomplete validation in `EditDistance` in TensorFlowCVE-2022-29208fixed in 2.6.4 +2