PT-2023-20219 · Google · Tensorflow

Dengyinlin · Publicado 2023-03-24 · Atualizado 2024-03-06 · CVE-2023-25659

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1

Description The issue arises when the parameter indices for DynamicStitch does not match the shape of the parameter data, potentially triggering a stack OOB read.

Recommendations For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. As a temporary workaround, consider validating the shape of the indices and data parameters to ensure they match before using DynamicStitch.

Exploit

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

AZL-31201

AZL-35305

BIT-TENSORFLOW-2023-25659

CVE-2023-25659

GHSA-93VR-9Q9M-PJ8P

Produtos afetados

Tensorflow

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25659.json · Exploit
• https://github.com/tensorflow/tensorflow · Nota
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-93vr-9q9m-pj8p · Aviso do Fabricante
• https://github.com/tensorflow/tensorflow/commit/ee004b18b976eeb5a758020af8880236cd707d05 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-25659 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25659 · Aviso do Fabricante
• https://t.me/cibsecurity/60731 · Publicação no Telegram
• https://t.me/cvenotify/47188 · Publicação no Telegram
• https://osv.dev/vulnerability/AZL-31201 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-35305 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25659 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-93vr-9q9m-pj8p · Aviso do Fabricante