PT-2023-20230 · Google · Tensorflow

R3Pwnx · Publicado 2023-03-24 · Atualizado 2024-03-06 · CVE-2023-25669

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1

Description The issue arises when the stride and window size are not positive for tf.raw ops.AvgPoolGrad, potentially causing a floating point exception.

Recommendations For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. As a temporary workaround, consider validating the stride and window size to ensure they are positive before using tf.raw ops.AvgPoolGrad.

Exploit

Correção

Enumeração de Fraquezas

CWE-697

Identificadores relacionados

AZL-31207

AZL-35314

BIT-TENSORFLOW-2023-25669

CVE-2023-25669

GHSA-RCF8-G8JV-VG6P

Produtos afetados

Tensorflow

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25669.json · Exploit
• https://github.com/tensorflow/tensorflow · Nota
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rcf8-g8jv-vg6p · Aviso do Fabricante
• https://github.com/tensorflow/tensorflow/commit/1295ae4dbb52fe06b19733b0257e2340d7b63b8d · Correção
• https://osv.dev/vulnerability/AZL-35314 · Aviso do Fabricante
• https://t.me/cvenotify/46854 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25669 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25669 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25669 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-31207 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rcf8-g8jv-vg6p · Aviso do Fabricante
• https://t.me/cibsecurity/60736 · Publicação no Telegram