CVE-2023-33976

Published: Jul 30, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12.

Affected (1)

Products: Google: Tensorflow

Google

1 product

Tensorflow

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Google Tensorflow	Before 2.13.0

Related CWEs

CWE-190

Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

References (6)

https://github.com/tensorflow/tensorflow/commit/6fa05df43b00038b048f4f0e51ef522da6532fec

Source: security-advisories@github.com

Patch

https://github.com/tensorflow/tensorflow/commit/915884fdf5df34aaedd00fc6ace33a2cfdefa586

Source: security-advisories@github.com

Patch

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gjh7-xx4r-x345

Source: security-advisories@github.com

Third Party Advisory

https://github.com/tensorflow/tensorflow/commit/6fa05df43b00038b048f4f0e51ef522da6532fec

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/tensorflow/tensorflow/commit/915884fdf5df34aaedd00fc6ace33a2cfdefa586

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/tensorflow/tensorflow/security/advisories/GHSA-gjh7-xx4r-x345

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.