Loading HuntDB...

GHSA-5wpj-c6f7-24x8

GitHub Security Advisory

Undefined behavior when users supply invalid resource handles

✓ GitHub Reviewed MODERATE Has CVE

Advisory Details

### Impact
Multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid:

```python
import tensorflow as tf

tf.raw_ops.QueueIsClosedV2(handle=[])
```

```python
import tensorflow as tf

tf.summary.flush(writer=())
```

In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior.

### Patches
We have patched the issue in GitHub commit [a5b89cd68c02329d793356bda85d079e9e69b4e7](https://github.com/tensorflow/tensorflow/commit/a5b89cd68c02329d793356bda85d079e9e69b4e7) and GitHub commit [dbdd98c37bc25249e8f288bd30d01e118a7b4498](https://github.com/tensorflow/tensorflow/commit/dbdd98c37bc25249e8f288bd30d01e118a7b4498).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Hong Jin from Singapore Management University.

Affected Packages

PyPI tensorflow
Affected versions: 0 (fixed in 2.6.4)
PyPI tensorflow
Affected versions: 2.7.0 (fixed in 2.7.2)
PyPI tensorflow
Affected versions: 2.8.0 (fixed in 2.8.1)
PyPI tensorflow-cpu
Affected versions: 0 (fixed in 2.6.4)
PyPI tensorflow-cpu
Affected versions: 2.7.0 (fixed in 2.7.2)
PyPI tensorflow-cpu
Affected versions: 2.8.0 (fixed in 2.8.1)
PyPI tensorflow-gpu
Affected versions: 0 (fixed in 2.6.4)
PyPI tensorflow-gpu
Affected versions: 2.7.0 (fixed in 2.7.2)
PyPI tensorflow-gpu
Affected versions: 2.8.0 (fixed in 2.8.1)

Related CVEs

Key Information

GHSA ID
GHSA-5wpj-c6f7-24x8
Published
May 24, 2022 10:13 PM
Last Modified
May 24, 2022 10:13 PM
CVSS Score
5.0 /10
Primary Ecosystem
PyPI
Primary Package
tensorflow
GitHub Reviewed
✓ Yes

Dataset

Last updated: September 12, 2025 6:34 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.