CVE-2023-25660

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-25660
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter `summarize` of `tf.raw_ops.Print` is zero, the new method `SummarizeArray<bool>` will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/tensorflow/tensorflow/commit/6d423b8bcc9aa9f5554dc988c1c16d038b508df1 Patch
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qjqc-vqcf-5qvj Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*
History

07 Nov 2023, 04:09

Type Values Removed Values Added
Summary TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter `summarize` of `tf.raw_ops.Print` is zero, the new method `SummarizeArray<bool>` will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1. TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when the parameter `summarize` of `tf.raw_ops.Print` is zero, the new method `SummarizeArray<bool>` will reference to a nullptr, leading to a seg fault. A fix is included in TensorFlow version 2.12 and version 2.11.1.
Information

Published : 2023-03-25 00:15

Updated : 2024-02-28 20:13

NVD link : CVE-2023-25660

Mitre link : CVE-2023-25660

CVE.ORG link : CVE-2023-25660

JSON object : View

Products Affected

google

  • tensorflow
CWE
CWE-476

NULL Pointer Dereference