Segfault in TensorFlow's array_ops.upper_bound
Summary
CVE-2023-33976: TensorFlow segfault in array_ops.upper_bound. Affects tensorflow versions < 2.12.1. Fixed in 2.12.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · PyPI
The same CVE-2023-33976 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an end-to-end open source platform for machine learning. It provides a comprehensive ecosystem for building and deploying machine learning models. The package is widely used in various industries and research fields.
Vulnerability Detail
The vulnerability in TensorFlow resides in the array_ops.upper_bound function. When this function is called without a rank 2 tensor, it causes a segmentation fault (segfault). This can lead to a crash or unexpected behavior in applications utilizing TensorFlow. The issue has been assigned a high severity rating due to its potential impact on the stability and reliability of machine learning workflows.
How To Fix
Minimum fixed version
2.12.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is currently no known workaround for this vulnerability. Users are recommended to update to the fixed versions of TensorFlow as soon as they become available.
Conclusion
The vulnerability in TensorFlow's array_ops.upper_bound function can lead to crashes and unexpected behavior in applications using TensorFlow. Users are advised to update to the fixed versions of TensorFlow (2.12.1 or 2.13) as soon as possible to mitigate the risk.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open source platform for machine learning, providing tools and libraries for building and deploying machine learning models.
The vulnerability can cause a segfault in TensorFlow, leading to crashes or unexpected behavior in applications using the affected function.
Versions prior to 2.12.1 of TensorFlow are affected by this vulnerability.
No, there is currently no known workaround for this vulnerability. Updating to the fixed versions of TensorFlow is the recommended solution.
You can find more information about this vulnerability in the vulnerability database maintained by Bitnami. The link to the specific vulnerability entry is provided in the database-specific section of this report.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
