CVE-2023-25801

Published: Mar 25, 2023Modified: Jun 17, 2026

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1.

Affected (1)

Products: Google: Tensorflow

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Tensorflow	Before 2.12.0

Related CWEs

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

References (4)

https://github.com/tensorflow/tensorflow/commit/ee50d1e00f81f62a4517453f721c634bbb478307

Source: security-advisories@github.com

Patch

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f49c-87jh-g47q

Source: security-advisories@github.com

PatchVendor Advisory

https://github.com/tensorflow/tensorflow/commit/ee50d1e00f81f62a4517453f721c634bbb478307

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-f49c-87jh-g47q

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.