PT-2023-20219 · Google · Tensorflow

Dengyinlin · Published 2023-03-24 · Updated 2024-03-06 · CVE-2023-25659

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1

Description The issue arises when the parameter indices for DynamicStitch does not match the shape of the parameter data, potentially triggering a stack OOB read.

Recommendations For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. As a temporary workaround, consider validating the shape of the indices and data parameters to ensure they match before using DynamicStitch.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

AZL-31201

AZL-35305

BIT-TENSORFLOW-2023-25659

CVE-2023-25659

GHSA-93VR-9Q9M-PJ8P

Affected Products

Tensorflow

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25659.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-93vr-9q9m-pj8p · Vendor Advisory
• https://github.com/tensorflow/tensorflow/commit/ee004b18b976eeb5a758020af8880236cd707d05 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-25659 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25659 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-31201 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35305 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25659 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-93vr-9q9m-pj8p · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/60731 · Telegram Post
• https://t.me/cvenotify/47188 · Telegram Post