CVE-2023-25671: TensorFlow tfg-translate Segmentation Fault Vulnerability
Summary
CVE-2023-25671: TensorFlow has segmentation fault in tfg-translate. Affects tensorflow versions < 2.11.1. Fixed in 2.11.1. How to fix ↓
Also tracked for
- tensorflow-cpu · PyPI
- tensorflow · Bitnami
The same CVE-2023-25671 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework widely used for developing and training machine learning models. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning applications. TensorFlow is vulnerable to a segmentation fault in the tfg-translate function, which can lead to out-of-bounds access due to mismatched integer type sizes in ValueMap::Manager::GetValueOrCreatePlaceholder. This vulnerability affects the generic functions used by the 'old importer' and can result in unauthorized access or execution of arbitrary code.
Vulnerability Detail
The vulnerability arises from a bug in the tfg-translate call to InitMlir, specifically when handling generic functions. Unlike non-generic functions, generic functions use the 'old importer,' which does not properly handle the mismatched integer type sizes. This can lead to out-of-bounds access and potential security breaches. The issue has been assigned a CVSS score of 7.5, indicating a high severity level. It is crucial to address this vulnerability promptly to prevent unauthorized access and potential code execution.
How To Fix
Latest published version: 2.21.0 as of 22 Oct 2026
pip install --upgrade "tensorflow==2.21.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.1
This is the first release that contains the fix.
pip install --upgrade "tensorflow==2.11.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can temporarily avoid using the tfg-translate function with generic functions. Instead, they can utilize non-generic functions or wait for the patched version of TensorFlow to be released. Here is an example of how to avoid the vulnerable code:
# Avoid using tfg-translate with generic functions
if not is_generic_function:
tfg_translate()
Conclusion
The TensorFlow tfg-translate segmentation fault vulnerability poses a significant risk of out-of-bounds access and potential security breaches. It is crucial to update to the patched version of TensorFlow (2.11.1 or higher) to mitigate this vulnerability. Alternatively, users can employ the provided workaround or seek further assistance from DevNack.com for vulnerability remediation support.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework used for developing and training machine learning models. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning applications.
The vulnerability in TensorFlow's tfg-translate function can lead to out-of-bounds access and potential security breaches. Attackers may exploit this vulnerability to gain unauthorized access or execute arbitrary code.
To fix this vulnerability, it is recommended to update TensorFlow to version 2.11.1 or higher. The issue has been patched in the GitHub repository, and the fix will be included in TensorFlow 2.12.0.
Yes, as a temporary workaround, users can avoid using the tfg-translate function with generic functions. They can utilize non-generic functions or wait for the patched version of TensorFlow to be released.
This vulnerability has been reported by r3pwnx, affiliated with 360 AIVul.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
