Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-49rq-hwc3-x77w

Опубликовано: 24 мар. 2023
Источник: github
Github: Прошло ревью
CVSS3: 7.5

Описание

TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantize

Impact

NPE in QuantizedMatMulWithBiasAndDequantize with MKL enable

import tensorflow as tf func = tf.raw_ops.QuantizedMatMulWithBiasAndDequantize para={'a': tf.constant(138, dtype=tf.quint8), 'b': tf.constant(4, dtype=tf.qint8), 'bias': [[31.81644630432129, 47.21876525878906], [109.95201110839844, 152.07968139648438]], 'min_a': 141.5337138686371, 'max_a': [73.84139251708984, 173.15280151367188], 'min_b': [], 'max_b': [[16.128345489501953, 193.26820373535156]], 'min_freezed_output': [], 'max_freezed_output': [115.50032806396484, 156.974853515625], 'Toutput': 1.0, 'transpose_a': True, 'transpose_b': False, 'input_quant_mode': 'MIN_FIRST'} func(**para)

Patches

We have patched the issue in GitHub commit 8a47a39d9697969206d23a523c977238717e8727.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx

Пакеты

Наименование

tensorflow

pip
Затронутые версииВерсия исправления

< 2.11.1

2.11.1

Наименование

tensorflow-cpu

pip
Затронутые версииВерсия исправления

< 2.11.1

2.11.1

Наименование

tensorflow-gpu

pip
Затронутые версииВерсия исправления

< 2.11.1

2.11.1

EPSS

Процентиль: 42%
0.002
Низкий

7.5 High

CVSS3

Дефекты

CWE-476

Связанные уязвимости

CVSS3: 7.5
nvd
почти 3 года назад

TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a null point error in QuantizedMatMulWithBiasAndDequantize with MKL enabled. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CVSS3: 7.5
msrc
больше 1 года назад

Описание отсутствует

CVSS3: 7.5
debian
почти 3 года назад

TensorFlow is an open source platform for machine learning. Versions p ...

EPSS

Процентиль: 42%
0.002
Низкий

7.5 High

CVSS3

Дефекты

CWE-476