PT-2023-20225 · Google · Tensorflow

Published 2023-03-24 · Updated 2024-03-06 · CVE-2023-25664

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1

Description There is a heap buffer overflow in TAvgPoolGrad. The issue can be exploited by using the tf.raw ops.AvgPoolGrad function with specific parameters, such as ksize, strides, padding, data format, orig input shape, and grad. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to 2.12.0, update to TensorFlow 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to TensorFlow 2.11.1 to resolve the issue. As a temporary workaround, consider avoiding the use of the tf.raw ops.AvgPoolGrad function until a patch is applied.

Exploit

Fix

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-122

CWE-120

Related Identifiers

AZL-31211

AZL-35309

BIT-TENSORFLOW-2023-25664

CVE-2023-25664

GHSA-6HG6-5C2Q-7RCR

Affected Products

Tensorflow

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25664.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6hg6-5c2q-7rcr · Patch
• https://github.com/tensorflow/tensorflow/commit/ddaac2bdd099bec5d7923dea45276a7558217e5b · Patch
• https://osv.dev/vulnerability/AZL-31211 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25664 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35309 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25664 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6hg6-5c2q-7rcr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25664 · Security Note
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/60723 · Telegram Post