PT-2023-20233 · Google · Tensorflow

R3Pwn · Published 2023-03-24 · Updated 2024-03-06 · CVE-2023-25671

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.11.1 TensorFlow versions prior to 2.12.0

Description TensorFlow is an open source platform for machine learning. There is out-of-bounds access due to mismatched integer type sizes. The issue is related to the ValueMap::Manager::GetValueOrCreatePlaceholder function and affects generic functions, which are using the "old importer".

Recommendations For versions prior to 2.11.1, update to version 2.11.1 to resolve the issue. For versions prior to 2.12.0, update to version 2.12.0 to resolve the issue.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

AZL-31204

AZL-35316

BIT-TENSORFLOW-2023-25671

CVE-2023-25671

GHSA-J5W9-HMFH-4CR6

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25671.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-j5w9-hmfh-4cr6 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/commit/760322a71ac9033e122ef1f4b1c62813021e5938 · Patch
• https://github.com/tensorflow/tensorflow/commit/2eedc8f676d2c3b8be9492e547b2bc814c10b367 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-25671 · Security Note
• https://osv.dev/vulnerability/AZL-31204 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25671 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25671 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j5w9-hmfh-4cr6 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35316 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/60734 · Telegram Post
• https://t.me/cvenotify/46852 · Telegram Post