PT-2023-20230 · Google · Tensorflow

R3Pwnx · Published 2023-03-24 · Updated 2024-03-06 · CVE-2023-25669

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 and 2.11.1

Description The issue arises when the stride and window size are not positive for tf.raw ops.AvgPoolGrad, potentially causing a floating point exception.

Recommendations For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. As a temporary workaround, consider validating the stride and window size to ensure they are positive before using tf.raw ops.AvgPoolGrad.

Exploit

Fix

Weakness Enumeration

CWE-697

Related Identifiers

AZL-31207

AZL-35314

BIT-TENSORFLOW-2023-25669

CVE-2023-25669

GHSA-RCF8-G8JV-VG6P

Affected Products

Tensorflow

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25669.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rcf8-g8jv-vg6p · Vendor Advisory
• https://github.com/tensorflow/tensorflow/commit/1295ae4dbb52fe06b19733b0257e2340d7b63b8d · Patch
• https://osv.dev/vulnerability/AZL-35314 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25669 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25669 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-31207 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rcf8-g8jv-vg6p · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cvenotify/46854 · Telegram Post
• https://t.me/cibsecurity/60736 · Telegram Post