PT-2023-20218 · Google · Tensorflow

R3Pwnx · Publicado 2023-03-24 · Atualizado 2024-03-06 · CVE-2023-25658

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1

Description TensorFlow, an open source platform for machine learning, has an issue where an out of bounds read occurs in GRUBlockCellGrad. The function tf.raw ops.GRUBlockCellGrad is affected, with parameters such as x, h prev, w ru, w c, b ru, b c, r, u, c, and d h being used. This issue has been reported and a fix is included in versions 2.12.0 and 2.11.1.

Recommendations For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. As a temporary workaround, consider restricting the use of the tf.raw ops.GRUBlockCellGrad function until a patch is applied.

Exploit

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

AZL-31199

AZL-35304

BIT-TENSORFLOW-2023-25658

CVE-2023-25658

GHSA-68V3-G9CM-RMM6

Produtos afetados

Tensorflow

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25658.json · Exploit
• https://github.com/tensorflow/tensorflow · Nota
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-68v3-g9cm-rmm6 · Correção
• https://github.com/tensorflow/tensorflow/commit/ff459137c2716a2a60f7d441b855fcb466d778cb · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-25658 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-31199 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25658 · Aviso do Fabricante
• https://t.me/cibsecurity/60725 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25658 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-68v3-g9cm-rmm6 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-35304 · Aviso do Fabricante