VYPR
Moderate severityNVD Advisory· Published May 20, 2022· Updated Apr 22, 2025

Segfault in TensorFlow if `tf.histogram_fixed_width` is called with NaN values

CVE-2022-29211

Description

TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.histogram_fixed_width is vulnerable to a crash when the values array contain Not a Number (NaN) elements. The implementation assumes that all floating point operations are defined and then converts a floating point result to an integer index. If values contains NaN then the result of the division is still NaN and the cast to int32 would result in a crash. This only occurs on the CPU implementation. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.6.42.6.4
tensorflowPyPI
>= 2.7.0, < 2.7.22.7.2
tensorflowPyPI
>= 2.8.0, < 2.8.12.8.1
tensorflow-cpuPyPI
< 2.6.42.6.4
tensorflow-cpuPyPI
>= 2.7.0, < 2.7.22.7.2
tensorflow-cpuPyPI
>= 2.8.0, < 2.8.12.8.1
tensorflow-gpuPyPI
< 2.6.42.6.4
tensorflow-gpuPyPI
>= 2.7.0, < 2.7.22.7.2
tensorflow-gpuPyPI
>= 2.8.0, < 2.8.12.8.1

Affected products

1

Patches

1
e57fd691c7b0

Prevent crash when histogram is called with NaN values.

https://github.com/tensorflow/tensorflowMihai MaruseacApr 20, 2022via ghsa
1 file changed · +11 2
  • tensorflow/core/kernels/histogram_op.cc+11 2 modified
    @@ -50,6 +50,15 @@ struct HistogramFixedWidthFunctor<CPUDevice, T, Tout> {
                             static_cast<double>(nbins);
         const double nbins_minus_1 = static_cast<double>(nbins - 1);
     
    +    // We cannot handle NANs in the algorithm below (due to the case to int32)
    +    const Eigen::Tensor<int32, 1, 1> nans_tensor =
    +        values.isnan().template cast<int32>();
    +    const Eigen::Tensor<int32, 0, 1> reduced_tensor = nans_tensor.sum();
    +    const int num_nans = reduced_tensor(0);
    +    if (num_nans > 0) {
    +      return errors::InvalidArgument("Histogram values must not contain NaN");
    +    }
    +
         // The calculation is done by finding the slot of each value in `values`.
         // With [a, b]:
         //   step = (b - a) / nbins
    @@ -98,12 +107,12 @@ class HistogramFixedWidthOp : public OpKernel {
         const auto nbins = nbins_tensor.scalar<int32>()();
     
         OP_REQUIRES(
    -        ctx, (value_range(0) < value_range(1)),
    +        ctx, value_range(0) < value_range(1),
             errors::InvalidArgument("value_range should satisfy value_range[0] < "
                                     "value_range[1], but got '[",
                                     value_range(0), ", ", value_range(1), "]'"));
         OP_REQUIRES(
    -        ctx, (nbins > 0),
    +        ctx, nbins > 0,
             errors::InvalidArgument("nbins should be a positive number, but got '",
                                     nbins, "'"));
     
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.