PT-2023-20232 · Google · Tensorflow

R3Pwnx · Publicado 2023-03-24 · Atualizado 2024-03-06 · CVE-2023-25670

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1

Description TensorFlow is an open source platform for machine learning. The issue is a null point error in QuantizedMatMulWithBiasAndDequantize with MKL enabled. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

Recommendations For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. As a temporary workaround, consider disabling the QuantizedMatMulWithBiasAndDequantize function with MKL enabled until a patch is available.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

AZL-31214

AZL-35315

BIT-TENSORFLOW-2023-25670

CVE-2023-25670

GHSA-49RQ-HWC3-X77W

Produtos afetados

Tensorflow

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25670.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/8a47a39d9697969206d23a523c977238717e8727 · Correção
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-49rq-hwc3-x77w · Aviso do Fabricante
• https://github.com/tensorflow/tensorflow · Nota
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25670 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25670 · Nota de Segurança
• https://t.me/cvenotify/46853 · Publicação no Telegram
• https://osv.dev/vulnerability/AZL-31214 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-49rq-hwc3-x77w · Aviso do Fabricante
• https://t.me/cibsecurity/60727 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25670 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-35315 · Aviso do Fabricante