CVE-2023-25666: TensorFlow AudioSpectrogram Floating Point Exception
Summary
CVE-2023-25666: TensorFlow has Floating Point Exception in AudioSpectrogram. Affects tensorflow versions < 2.12.0. Fixed in 2.12.0. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · PyPI
The same CVE-2023-25666 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TensorFlow is an open source platform for machine learning. It provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models. TensorFlow is widely used in various domains, including research, industry, and academia. The AudioSpectrogram module in TensorFlow is responsible for generating spectrograms from audio data. Spectrograms are visual representations of the frequency content of audio signals over time. They are commonly used in tasks such as speech recognition and audio classification. However, prior to versions 2.12.0 and 2.11.1, there is a floating point exception vulnerability in the AudioSpectrogram module.
Vulnerability Detail
The floating point exception vulnerability in TensorFlow's AudioSpectrogram module can lead to unexpected program termination or crashes when processing certain audio data. This vulnerability arises due to improper handling of floating point calculations, which can result in division by zero or other undefined operations. An attacker could potentially exploit this vulnerability to cause a denial of service (DoS) condition or execute arbitrary code on a vulnerable system. The impact of this vulnerability depends on the context in which TensorFlow is used and the privileges of the user running the affected application. It is important to note that this vulnerability has been addressed in TensorFlow versions 2.12.0 and 2.11.1.
How To Fix
Minimum fixed version
2.12.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The floating point exception vulnerability in TensorFlow's AudioSpectrogram module can have serious consequences, including unexpected program termination, crashes, denial of service (DoS) conditions, and potential arbitrary code execution. It is crucial to update TensorFlow to version 2.12.0 or 2.11.1 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning that provides a comprehensive ecosystem of tools, libraries, and resources for developing and deploying machine learning models.
The AudioSpectrogram module in TensorFlow is responsible for generating spectrograms from audio data. Spectrograms are visual representations of the frequency content of audio signals over time.
A floating point exception occurs when a floating point operation, such as division by zero or other undefined operations, leads to an invalid result or an exceptional condition.
The impact of this vulnerability depends on the context in which TensorFlow is used and the privileges of the user running the affected application. It can lead to unexpected program termination or crashes, potentially causing a denial of service (DoS) condition or enabling arbitrary code execution.
To mitigate this vulnerability, it is recommended to update TensorFlow to version 2.12.0 or 2.11.1, which include a fix for the floating point exception in the AudioSpectrogram module.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
