TensorFlow has Floating Point Exception in TFLite in conv kernel

CAO 7.5CVE-2023-27579 · BIT-tensorflow-2023-27579 · GHSA-5w96-866f-6rm8 · Công bố 25/03/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-27579 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng tensorflow, tensorflow-cpu, tensorflow-gpu.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.39%, cao hơn 33.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.11.1, 2.12.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
tensorflow PyPI	`< 2.11.1`	`2.11.1`
tensorflow-cpu PyPI	`< 2.11.1`	`2.11.1`
tensorflow-gpu PyPI	`< 2.11.1`	`2.11.1`
tensorflow google	`< 2.12.0`	`2.12.0`

Mô tả

Impact

Constructing a tflite model with a paramater filter_input_channel of less than 1 gives a FPE.

Patches

We have patched the issue in GitHub commit 34f8368c535253f5c9cb3a303297743b62442aaa.

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability was reported by Wang Xuan of Qihoo 360 AIVul Team.

Mô tả của NVD

TensorFlow is an end-to-end open source platform for machine learning. Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE. This issue has been patched in version 2.12. TensorFlow will also cherrypick the fix commit on TensorFlow 2.11.1.