GHSA-f637-vh3r-vfh2 TensorFlow has Floating Point Exception in AudioSpectrogram

• PyPI tensorflow: < 2.11.1 → fixed in 2.11.1 • PyPI tensorflow-cpu: < 2.11.1 → fixed in 2.11.1 • PyPI tensorflow-gpu: < 2.11.1 → fixed in 2.11.1

Impact version:2.11.0 //core/ops/audio_ops.cc:70 Status SpectrogramShapeFn(InferenceContext* c) { ShapeHandle input; TF_RETURN_IF_ERROR(c->WithRank(c->input(0), 2, &input)); int32_t window_size; TF_RETURN_IF_ERROR(c->GetAttr("window_size", &window_size)); int32_t stride; TF_RETURN_IF_ERROR(c->GetAttr("stride", &stride)); .....[1] DimensionHandle input_length = c->Dim(input, 0); DimensionHandle input_channels = c->Dim(input, 1); DimensionHandle output_length; if (!c->ValueKnown(input_length)) { output_length = c->UnknownDim(); } else { const int64_t input_length_value = c->Value(input_length); const int64_t length_minus_window = (input_length_value - window_size); int64_t output_length_value; if (length_minus_window MakeDim(output_length_value); } Get the value of stride at [1], and the used at [2] ```python import tensorflow as tf para = {'input': tf.constant([[14.], [24.]], dtype=tf.float32), 'window_size': 1, 'stride': 0, 'magnitude_squared': False} func = tf.raw_ops.AudioSpectrogram @tf.function(jit_compile=True) def fuzz_jit(): y = func(**para) return y fuzz_jit() ``` Patches We have patched the issue in GitHub commit d0d4e779da0d0f56499c6fa5ba09f0a576cc6b14. The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1 For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by r3pwnx