GitHub Advisoryadvisory · PyPI

GHSA-gjh7-xx4r-x345 TensorFlow has segfault in array_ops.upper_bound

HIGH Published 2024-07-30 Modified 2024-07-30 Official page ↗
Aliases
CVE-2023-33976
Ecosystem
PyPI
Packages
tensorflow, tensorflow-cpu, tensorflow-gpu
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-190
Reviewed
2024-07-30

Affected packages

• PyPI tensorflow: < 2.12.1 → fixed in 2.12.1 • PyPI tensorflow-cpu: < 2.12.1 → fixed in 2.12.1 • PyPI tensorflow-gpu: < 2.12.1 → fixed in 2.12.1

Description

Impact `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. Patches We have patched the issue in GitHub commit 915884fdf5df34aaedd00fc6ace33a2cfdefa586. The fix will be included in TensorFlow 2.13. We will also cherrypick this commit in TensorFlow 2.12.1. For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions. Attribution This vulnerability has been reported by dmc1778

Related

Alias · CVE (1)

  • CVE-2023-33976 TensorFlow is an end-to-end open source platform for machine learning. vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References