CVE-2023-25676

published 2023-03-25

CVE-2023-25676: TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.ParallelConcat` segfaults with a…

high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, `tf.raw_ops.ParallelConcat` segfaults with a nullptr dereference when given a parameter `shape` with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	tensorflow	—	—
google	tensorflow	< 2.12.0	2.12.0
intel	optimization_for_tensorflow	>= 0 < 2.11.1	2.11.1
msrc	azl3_tensorflow_2.11.1-1_on_azure_linux_3.0	—	—
msrc	azure_linux_3.0_arm	—	—
msrc	azure_linux_3.0_x64	—	—
msrc	cbl2_tensorflow_2.11.1-1_on_cbl_mariner_2.0	—	—
tensorflow	tensorflow	< 2.11.1	2.11.1

CWE-476