PT-2023-20218 · Google · Tensorflow

R3Pwnx · Published 2023-03-24 · Updated 2024-03-06 · CVE-2023-25658

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1

Description TensorFlow, an open source platform for machine learning, has an issue where an out of bounds read occurs in GRUBlockCellGrad. The function tf.raw ops.GRUBlockCellGrad is affected, with parameters such as x, h prev, w ru, w c, b ru, b c, r, u, c, and d h being used. This issue has been reported and a fix is included in versions 2.12.0 and 2.11.1.

Recommendations For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. As a temporary workaround, consider restricting the use of the tf.raw ops.GRUBlockCellGrad function until a patch is applied.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

AZL-31199

AZL-35304

BIT-TENSORFLOW-2023-25658

CVE-2023-25658

GHSA-68V3-G9CM-RMM6

Affected Products

Tensorflow

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25658.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-68v3-g9cm-rmm6 · Patch
• https://github.com/tensorflow/tensorflow/commit/ff459137c2716a2a60f7d441b855fcb466d778cb · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-25658 · Security Note
• https://osv.dev/vulnerability/AZL-31199 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25658 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25658 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-68v3-g9cm-rmm6 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35304 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/60725 · Telegram Post