GHSA-gw97-ff7c-9v96: TensorFlow vulnerable to heap out-of-buffer read in the QuantizeAndDequantize operation

Q: What upgrade targets address this issue?

The fix is included in TensorFlow 2.12.0 and was also cherrypicked to TensorFlow 2.11.1. Deploy one of these fixed versions rather than continuing to use an earlier affected release.

Published Mar 24, 2023

Updated

TensorFlow is an open source platform for machine learning. Attackers using Tensorflow prior to 2.12.0 or 2.11.1 can access heap memory which is not in the control of user, leading to a crash or remote code execution. The fix will be included in TensorFlow version 2.12.0 and will also cherrypick this commit on TensorFlow version 2.11.1.

Affected Software

1 affected component

Google TensorFlow<2.12.0, <2.11.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tensorflow to a version that resolves this vulnerability.
Fixed in 2.12.0
Upgrade
Upgrade tensorflow to a version that resolves this vulnerability.
Fixed in 2.11.1

Event History

Mar 24, 2023

CVE Published

via OSV·11:33 PM

Data Sourced

via OSV·11:33 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What upgrade targets address this issue?

The fix is included in TensorFlow 2.12.0 and was also cherrypicked to TensorFlow 2.11.1. Deploy one of these fixed versions rather than continuing to use an earlier affected release.

GHSA-gw97-ff7c-9v96: TensorFlow vulnerable to heap out-of-buffer read in the QuantizeAndDequantize operation

Affected Software

Remediation

Event History

Frequently Asked Questions

What upgrade targets address this issue?

Company

Resources

Contact

Frequently Asked Questions

What upgrade targets address this issue?