PT-2023-21221 · Google · Tensorflow

Wang Xuan · Published 2023-03-24 · Updated 2024-03-06 · CVE-2023-27579

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.12 TensorFlow version 2.11.1 and earlier

Description Constructing a tflite model with a parameter filter input channel of less than 1 gives a Floating Point Exception (FPE). This issue affects TensorFlow, an end-to-end open source platform for machine learning.

Recommendations For versions prior to 2.12, update to version 2.12 or later to resolve the issue. For version 2.11.1 and earlier, wait for the fix commit to be cherry-picked or update to a newer version when available. As a temporary workaround, consider avoiding the construction of tflite models with a filter input channel parameter of less than 1 until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-697

Related Identifiers

AZL-31208

AZL-35323

BIT-TENSORFLOW-2023-27579

CVE-2023-27579

GHSA-5W96-866F-6RM8

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27579.json · Exploit
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-5w96-866f-6rm8 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/commit/34f8368c535253f5c9cb3a303297743b62442aaa · Patch
• https://osv.dev/vulnerability/AZL-31208 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-27579 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35323 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2023-27579 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27579 · Security Note
• https://osv.dev/vulnerability/GHSA-5w96-866f-6rm8 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://t.me/cibsecurity/60737 · Telegram Post
• https://t.me/cvenotify/46845 · Telegram Post
• https://t.me/cvenotify/47176 · Telegram Post