CVE-2023-25667: Integer Overflow Vulnerability in TensorFlow
Summary
CVE-2023-25667: TensorFlow vulnerable to segfault when opening multiframe gif. Affects tensorflow versions < 2.12.0. Fixed in 2.12.0. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · PyPI
The same CVE-2023-25667 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. This vulnerability affects versions prior to 2.12.0 and 2.11.1 of TensorFlow.
Vulnerability Detail
The vulnerability in TensorFlow is related to an integer overflow issue. Specifically, when the product of the number of frames, height, width, and channels in an input exceeds the maximum representable value, an integer overflow occurs. This can be triggered when the value falls within the range of 2^31 <= num_frames * height * width * channels < 2^32. For example, a Full HD screencast with at least 346 frames can trigger this vulnerability. The integer overflow can lead to unexpected behavior and potential security risks.
How To Fix
Minimum fixed version
2.12.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update TensorFlow to the fixed versions.
Conclusion
In conclusion, the integer overflow vulnerability in TensorFlow can be mitigated by updating the package to version 2.12.0 or version 2.11.1. It is important to keep software up to date to ensure security and protect against potential risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides tools and resources for developing and deploying machine learning models.
Versions prior to 2.12.0 and 2.11.1 of TensorFlow are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities.
The integer overflow vulnerability in TensorFlow can lead to unexpected behavior and potential security risks. It is important to update to the fixed versions to ensure the software is secure.
There are no specific workarounds mentioned for this vulnerability. It is recommended to update TensorFlow to the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
