TensorFlow has Floating Point Exception in TFLite in conv kernel

HOCH 7.5CVE-2023-27579 · BIT-tensorflow-2023-27579 · GHSA-5w96-866f-6rm8 · Published 25/03/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-27579 ist eine Schwachstelle (HOCH (CVSS 7.5)) in tensorflow, tensorflow-cpu, tensorflow-gpu.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.39%, höher als bei 33.8% aller Schwachstellen.
Abhilfe: auf 2.11.1, 2.12.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
tensorflow PyPI	`< 2.11.1`	`2.11.1`
tensorflow-cpu PyPI	`< 2.11.1`	`2.11.1`
tensorflow-gpu PyPI	`< 2.11.1`	`2.11.1`
tensorflow google	`< 2.12.0`	`2.12.0`

Description

Impact

Constructing a tflite model with a paramater filter_input_channel of less than 1 gives a FPE.

Patches

We have patched the issue in GitHub commit 34f8368c535253f5c9cb3a303297743b62442aaa.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability was reported by Wang Xuan of Qihoo 360 AIVul Team.

NVD description

TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. This issue has been patched in version 2.12. TensorFlow will also cherrypick the fix commit on TensorFlow 2.11.1.