PT-2023-21221 · Google · Tensorflow

Wang Xuan · Publicado 2023-03-24 · Atualizado 2024-03-06 · CVE-2023-27579

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12 TensorFlow version 2.11.1 and earlier

Description Constructing a tflite model with a parameter filter input channel of less than 1 gives a Floating Point Exception (FPE). This issue affects TensorFlow, an end-to-end open source platform for machine learning.

Recommendations For versions prior to 2.12, update to version 2.12 or later to resolve the issue. For version 2.11.1 and earlier, wait for the fix commit to be cherry-picked or update to a newer version when available. As a temporary workaround, consider avoiding the construction of tflite models with a filter input channel parameter of less than 1 until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-697

Identificadores relacionados

AZL-31208

AZL-35323

BIT-TENSORFLOW-2023-27579

CVE-2023-27579

GHSA-5W96-866F-6RM8

Produtos afetados

Tensorflow

Referências · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27579.json · Exploit
• https://github.com/tensorflow/tensorflow · Nota
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5w96-866f-6rm8 · Aviso do Fabricante
• https://github.com/tensorflow/tensorflow/commit/34f8368c535253f5c9cb3a303297743b62442aaa · Correção
• https://osv.dev/vulnerability/AZL-31208 · Aviso do Fabricante
• https://t.me/cibsecurity/60737 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-27579 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-35323 · Aviso do Fabricante
• https://t.me/cvenotify/46845 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-tensorflow-2023-27579 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-27579 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-5w96-866f-6rm8 · Aviso do Fabricante
• https://t.me/cvenotify/47176 · Publicação no Telegram