PT-2024-12453 · Google · Tensorflow

Dmc1778 · Published 2024-07-30 · Updated 2024-10-01 · CVE-2023-33976

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.13 TensorFlow versions 2.12 and earlier

Description The issue is caused by array ops.upper bound when not given a rank 2 tensor, resulting in a segfault. The estimated number of potentially affected devices worldwide is not provided. There is no information about real-world incidents where this issue was exploited.

Technical details about exploitation include:

• array ops.upper bound causes a segfault when not given a rank 2 tensor.

Recommendations For TensorFlow versions prior to 2.13, update to version 2.13 or later to resolve the issue. For TensorFlow versions 2.12 and earlier, update to version 2.12.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of array ops.upper bound with tensors that are not rank 2 until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

AZL-47242

BIT-TENSORFLOW-2023-33976

CVE-2023-33976

GHSA-GJH7-XX4R-X345

Affected Products

Tensorflow

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33976.json · Exploit
• https://github.com/tensorflow/tensorflow/commit/6fa05df43b00038b048f4f0e51ef522da6532fec · Patch
• https://github.com/tensorflow/tensorflow/commit/915884fdf5df34aaedd00fc6ace33a2cfdefa586 · Patch
• https://osv.dev/vulnerability/GHSA-gjh7-xx4r-x345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33976 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33976 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2023-33976 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-47242 · Vendor Advisory
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gjh7-xx4r-x345 · Note
• https://twitter.com/oktsec/status/1822909428930171188 · Twitter Post
• https://t.me/cvedetector/2074 · Telegram Post
• https://t.me/cvenotify/96690 · Telegram Post