github.com
https://github.com/tensorflow/tensorflow CVE-2023-25668
CRITICAL
TensorFlow vulnerable to heap out-of-buffer read in the QuantizeAndDequantize operation
Record summary
CVE-2023-25668 has a selected CVSS score of 9.8 (critical).
Description
TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the control of user, leading to a crash or remote code execution. The fix will be included in TensorFlow version 2.12.0 and will also cherrypick this commit on TensorFlow version 2.11.1.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 19, 2025 · Source: CVE List
Affected products and versions
4| Product | Source | Version range | Status |
|---|---|---|---|
tensorflowBrowse tensorflow / tensorflow | CVE List | < 2.11.1 | affected |
tensorflowBrowse PyPI / tensorflow | GitHub Advisory | Before 2.11.1 · Fixed in 2.11.1 | affected |
tensorflow-cpuBrowse PyPI / tensorflow-cpu | GitHub Advisory | Before 2.11.1 · Fixed in 2.11.1 | affected |
tensorflow-gpuBrowse PyPI / tensorflow-gpu | GitHub Advisory | Before 2.11.1 · Fixed in 2.11.1 | affected |
References
4github.com
https://github.com/tensorflow/tensorflow/commit/7b174a0f2e40ff3f3aa957aecddfd5aaae35eccb github.comConfirmation
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gw97-ff7c-9v96 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-25668