Advisoriesby IbisTensorFlowGHSA-5w96-866f-6rm8
TensorFlow has Floating Point Exception in TFLite in conv kernel
Fix: upgrade to 2.11.1 or later
Impact
Constructing a tflite model with a paramater filter_input_channel of less than 1 gives a FPE.
Patches
We have patched the issue in GitHub commit [34f8368c535253f5c9cb3a303297743b62442aaa](https://github.com/tensorflow/tensorflow/commit/34f8368c535253f5c9cb3a303297743b62442aaa).
The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.
For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Attribution
This vulnerability was reported by Wang Xuan of Qihoo 360 AIVul Team.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| tensorflow PyPI | < 2.11.1 | 2.11.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-697
- Also known as
- BIT-tensorflow-2023-27579, CVE-2023-27579, PYSEC-2026-3111, PYSEC-2026-3279, PYSEC-2026-954
More TensorFlow advisories
All TensorFlow
TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitchCVE-2023-25659fixed in 2.11.1TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`CVE-2023-25660fixed in 2.11.1TensorFlow vulnerable to integer overflow in EditDistanceCVE-2023-25662fixed in 2.11.1TensorFlow has Null Pointer Error in TensorArrayConcatV2CVE-2023-25663fixed in 2.11.1TensorFlow has Heap-buffer-overflow in AvgPoolGradCVE-2023-25664fixed in 2.11.1TensorFlow has Null Pointer Error in SparseSparseMaximumCVE-2023-25665fixed in 2.11.1