CVE-2023-33976: TensorFlow segfault in array_ops.upper_bound
Impact arrayops.upperbound causes a segfault when not given a rank 2 tensor.
Patches We have patched the issue in GitHub commit 915884fdf5df34aaedd00fc6ace33a2cfdefa586.
The fix will be included in TensorFlow 2.13. We will also cherrypick this commit in TensorFlow 2.12.1.
For more information Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.
Attribution This vulnerability has been reported by dmc1778
Other sources
TensorFlow is an end-to-end open source platform for machine learning. arrayops.upperbound causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12.
— MITRE
TensorFlow segfault in arrayops.upperbound
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-33976?
CVE-2023-33976 has a moderate severity rating due to the potential for causing a segmentation fault.
How do I fix CVE-2023-33976?
To fix CVE-2023-33976, update to TensorFlow version 2.12.1 or later.
What software is affected by CVE-2023-33976?
CVE-2023-33976 affects TensorFlow versions prior to 2.13.0 for tensorflow-gpu, tensorflow-cpu, and tensorFlow packages.
What specific issue does CVE-2023-33976 address?
CVE-2023-33976 addresses a segmentation fault occurring when `array_ops.upper_bound` is called with a tensor that is not rank 2.
Is there a patch for CVE-2023-33976?
Yes, a patch for CVE-2023-33976 has been released in GitHub commit 915884fdf5df34aaedd00fc6ace33a2cfdefa586.