CVE-2023-25664

Summary

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a heap buffer overflow in TAvgPoolGrad. A fix is included in TensorFlow 2.12.0 and 2.11.1.

Affected Software

Weaknesses

• CWE-120: CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CWE-122: CWE-122: Heap-based Buffer Overflow

ADP Enrichment

CVE Program Container

Additional References

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6hg6-5c2q-7rcr
• https://github.com/tensorflow/tensorflow/commit/ddaac2bdd099bec5d7923dea45276a7558217e5b

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-6hg6-5c2q-7rcr
• https://github.com/tensorflow/tensorflow/commit/ddaac2bdd099bec5d7923dea45276a7558217e5b

• ←Previous
• Next→