CVE-2023-25670 TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantize

2023-03-2423:32:12

CWE-476

GitHub_M

www.cve.org

tensorflow

null pointer error

quantizedmatmulwithbiasanddequantize

cve-2023-25670

machine learning

open source

mkl

fix

version 2.12.0

version 2.11.1

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

37.9%

JSON

TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a null point error in QuantizedMatMulWithBiasAndDequantize with MKL enabled. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

CNA Affected

[
  {
    "vendor": "tensorflow",
    "product": "tensorflow",
    "versions": [
      {
        "version": "< 2.11.1",
        "status": "affected"
      }
    ]
  }
]