PT-2023-20235 · Google · Tensorflow

R3Pwnx · Publicado 2023-03-24 · Atualizado 2024-03-06 · CVE-2023-25673

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1

Description TensorFlow is an open source platform for machine learning. The issue is related to a Floating Point Exception in TensorListSplit with XLA. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

Recommendations For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. As a temporary workaround, consider avoiding the use of tf.raw ops.TensorListSplit with vulnerable parameters, such as element shape set to -1 and lengths set to [0], until a patch is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-697

Identificadores relacionados

AZL-31213

AZL-35318

BIT-TENSORFLOW-2023-25673

CVE-2023-25673

GHSA-647V-R7QQ-24FH

Produtos afetados

Tensorflow

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25673.json · Exploit
• https://github.com/tensorflow/tensorflow · Nota
• https://github.com/tensorflow/tensorflow/commit/728113a3be690facad6ce436660a0bc1858017fa · Correção
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-647v-r7qq-24fh · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-35318 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25673 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25673 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25673 · Aviso do Fabricante
• https://t.me/cvenotify/47169 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-647v-r7qq-24fh · Aviso do Fabricante
• https://t.me/cibsecurity/60724 · Publicação no Telegram
• https://t.me/cvenotify/46850 · Publicação no Telegram
• https://osv.dev/vulnerability/AZL-31213 · Aviso do Fabricante