{"id":"CVE-2022-29210","summary":"Heap buffer overflow due to incorrect hash function in TensorFlow","details":"TensorFlow is an open source platform for machine learning. In version 2.8.0, the `TensorKey` hash function used total estimated `AllocatedBytes()`, which (a) is an estimate per tensor, and (b) is a very poor hash function for constants (e.g. `int32_t`). It also tried to access individual tensor bytes through `tensor.data()` of size `AllocatedBytes()`. This led to ASAN failures because the `AllocatedBytes()` is an estimate of total bytes allocated by a tensor, including any pointed-to constructs (e.g. strings), and does not refer to contiguous bytes in the `.data()` buffer. The discoverers could not use this byte vector anyway because types such as `tstring` include pointers, whereas they needed to hash the string values themselves. This issue is patched in Tensorflow versions 2.9.0 and 2.8.1.","aliases":["BIT-tensorflow-2022-29210","GHSA-hc2f-7r5r-r2hg","PYSEC-2026-1007","PYSEC-2026-3200","PYSEC-2026-3339"],"modified":"2026-08-12T13:00:49.923596Z","published":"2022-05-20T23:25:21Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-120","CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29210.json"},"references":[{"type":"WEB","url":"https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/framework/tensor_key.h#L53-L64"},{"type":"WEB","url":"https://github.com/tensorflow/tensorflow/releases/tag/v2.8.1"},{"type":"WEB","url":"https://github.com/tensorflow/tensorflow/releases/tag/v2.9.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29210.json"},{"type":"ADVISORY","url":"https://github.com/tensorflow/tensorflow/security/advisories/GHSA-hc2f-7r5r-r2hg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-29210"},{"type":"FIX","url":"https://github.com/tensorflow/tensorflow/commit/1b85a28d395dc91f4d22b5f9e1e9a22e92ccecd6"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/tensorflow/tensorflow","events":[{"introduced":"3f878cff5b698b82eea85db2b60d65a2e320850e"},{"fixed":"1b85a28d395dc91f4d22b5f9e1e9a22e92ccecd6"},{"fixed":"0516d4d8bced506cae97dc3cb45dbd2fe4311f26"},{"fixed":"8a20d54a3c1bfa38c03ea99a2ad3c1b0a45dfa95"}],"database_specific":{"cpe":"cpe:2.3:a:google:tensorflow:2.8.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.8.0"},{"last_affected":"2.8.0"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["2.8.0","== 2.8.0","v2.8.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-29210.json","vanir_signatures_modified":"2026-08-12T13:00:49Z","vanir_signatures":[{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["237402921825723447565199887043303787672","299527265743863579664941261506298943828","164770456384197013918306646599530011207","163672607010735226609951211929024606412","335815136775634078230514142897709741145","40452105548669812494022794328861799896","256379628055479489651229002199689148184","240522512309630831697827857464120036961","63023319149774050960125992398873200987","115986887373827876102682101560048162083","119258988697698457769296765622298402469","263748380230038750863257602792872601509","134450869686610018819993254480043254757","265929640739591537554502801626236160830","17480181784671913083921673859944354529","14707977503021735529745178994830995575","245066591165824187058789977277140319959","213402551029742966256968955674334903337","289758884718391109214619386143212157238","226199732699636890285467587624525439656","198195069102512105581904064602191529371","214101176783306874107672050297527301621"]},"id":"CVE-2022-29210-ac998f46","signature_type":"Line","signature_version":"v1","source":"https://github.com/tensorflow/tensorflow/commit/1b85a28d395dc91f4d22b5f9e1e9a22e92ccecd6","target":{"file":"tensorflow/core/framework/tensor_key.h"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}