PT-2023-20238 · Google · Tensorflow

R3Pwnx · Publicado 2023-03-24 · Atualizado 2024-03-06 · CVE-2023-25676

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1

Description The issue occurs when running TensorFlow with XLA, where tf.raw ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.

Recommendations For versions prior to 2.12.0, update to TensorFlow 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to TensorFlow 2.11.1 to resolve the issue. As a temporary workaround, consider avoiding the use of tf.raw ops.ParallelConcat with a shape parameter of rank not greater than zero until a patch is available.

Exploit

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

AZL-31203

AZL-35321

BIT-TENSORFLOW-2023-25676

CVE-2023-25676

GHSA-6WFH-89Q8-44JQ

Produtos afetados

Tensorflow

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25676.json · Exploit
• https://github.com/tensorflow/tensorflow · Nota
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6wfh-89q8-44jq · Aviso do Fabricante
• https://github.com/tensorflow/tensorflow/commit/da66bc6d5ff466aee084f9e7397980a24890cd15 · Correção
• https://osv.dev/vulnerability/GHSA-6wfh-89q8-44jq · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25676 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-31203 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-25676 · Aviso do Fabricante
• https://t.me/cvenotify/46847 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-25676 · Nota de Segurança
• https://t.me/cibsecurity/60738 · Publicação no Telegram
• https://osv.dev/vulnerability/AZL-35321 · Aviso do Fabricante