PT-2023-20238 · Google · Tensorflow

R3Pwnx · Published 2023-03-24 · Updated 2024-03-06 · CVE-2023-25676

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12.0 TensorFlow versions prior to 2.11.1

Description The issue occurs when running TensorFlow with XLA, where tf.raw ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero.

Recommendations For versions prior to 2.12.0, update to TensorFlow 2.12.0 to resolve the issue. For versions prior to 2.11.1, update to TensorFlow 2.11.1 to resolve the issue. As a temporary workaround, consider avoiding the use of tf.raw ops.ParallelConcat with a shape parameter of rank not greater than zero until a patch is available.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

AZL-31203

AZL-35321

BIT-TENSORFLOW-2023-25676

CVE-2023-25676

GHSA-6WFH-89Q8-44JQ

Affected Products

Tensorflow

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25676.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6wfh-89q8-44jq · Vendor Advisory
• https://github.com/tensorflow/tensorflow/commit/da66bc6d5ff466aee084f9e7397980a24890cd15 · Patch
• https://osv.dev/vulnerability/GHSA-6wfh-89q8-44jq · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2023-25676 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-31203 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25676 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25676 · Security Note
• https://osv.dev/vulnerability/AZL-35321 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cvenotify/46847 · Telegram Post
• https://t.me/cibsecurity/60738 · Telegram Post