GHSA-f49c-87jh-g47q

Опубликовано: 24 мар. 2023

Источник: github

Github: Прошло ревью

CVSS3: 8

Описание

TensorFlow has double free in Fractional(Max/Avg)Pool

Impact

nn_ops.fractional_avg_pool_v2 and nn_ops.fractional_max_pool_v2 require the first and fourth elements of their parameter pooling_ratio to be equal to 1.0, as pooling on batch and channel dimensions is not supported.

import tensorflow as tf import os import numpy as np from tensorflow.python.ops import nn_ops try: arg_0_tensor = tf.random.uniform([3, 30, 50, 3], dtype=tf.float64) arg_0 = tf.identity(arg_0_tensor) arg_1_0 = 2 arg_1_1 = 3 arg_1_2 = 1 arg_1_3 = 1 arg_1 = [arg_1_0,arg_1_1,arg_1_2,arg_1_3,] arg_2 = True arg_3 = True seed = 341261001 out = nn_ops.fractional_avg_pool_v2(arg_0,arg_1,arg_2,arg_3,seed=seed,) except Exception as e: print("Error:"+str(e))

Patches

We have patched the issue in GitHub commit ee50d1e00f81f62a4517453f721c634bbb478307.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability was reported by dmc1778, of nimashiri2012@gmail.com.

Ссылки

Пакеты

Наименование

tensorflow

pip

Затронутые версииВерсия исправления

< 2.11.1

2.11.1

Наименование

tensorflow-cpu

pip

Затронутые версииВерсия исправления

< 2.11.1

2.11.1

Наименование

tensorflow-gpu

pip

Затронутые версииВерсия исправления

< 2.11.1

2.11.1

EPSS

Процентиль: 23%

0.00078

Низкий

8 High

CVSS3

CVE ID

CVE-2023-25801

Дефекты

CWE-415

Связанные уязвимости

CVE-2023-25801

CVSS3: 8

nvd

почти 3 года назад

TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1.

CVE-2023-25801

CVSS3: 7.8

msrc

больше 1 года назад

Описание отсутствует

CVE-2023-25801

CVSS3: 8

debian

почти 3 года назад

TensorFlow is an open source machine learning platform. Prior to versi ...

EPSS

Процентиль: 23%

0.00078

Низкий

8 High

CVSS3

CVE ID

CVE-2023-25801

Дефекты

CWE-415