PT-2023-20233 · Google · Tensorflow

R3Pwn · Publicado 2023-03-24 · Atualizado 2024-03-06 · CVE-2023-25671

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11.1 TensorFlow versions prior to 2.12.0

Description TensorFlow is an open source platform for machine learning. There is out-of-bounds access due to mismatched integer type sizes. The issue is related to the ValueMap::Manager::GetValueOrCreatePlaceholder function and affects generic functions, which are using the "old importer".

Recommendations For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue.

Exploit

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

AZL-31204

AZL-35316

BIT-TENSORFLOW-2023-25671

CVE-2023-25671

GHSA-J5W9-HMFH-4CR6

Produtos afetados

Tensorflow

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25671.json · Exploit
• https://github.com/tensorflow/tensorflow · Nota
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j5w9-hmfh-4cr6 · Aviso do Fabricante
• https://github.com/tensorflow/tensorflow/commit/760322a71ac9033e122ef1f4b1c62813021e5938 · Correção
• https://github.com/tensorflow/tensorflow/commit/2eedc8f676d2c3b8be9492e547b2bc814c10b367 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-25671 · Nota de Segurança
• https://osv.dev/vulnerability/AZL-31204 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25671 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-25671 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-j5w9-hmfh-4cr6 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-35316 · Aviso do Fabricante
• https://t.me/cibsecurity/60734 · Publicação no Telegram
• https://t.me/cvenotify/46852 · Publicação no Telegram