CVE-2023-25663: NULL Pointer Dereference

March 25, 2023 (updated March 30, 2023)

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, when ctx->step_containter() is a null ptr, the Lookup function will be executed with a null pointer. A fix is included in TensorFlow 2.12.0 and 2.11.1.

References

github.com/advisories/GHSA-64jg-wjww-7c5w
github.com/tensorflow/tensorflow/commit/239139d2ae6a81ae9ba499ad78b56d9b2931538a
github.com/tensorflow/tensorflow/security/advisories/GHSA-64jg-wjww-7c5w

Code Behaviors & Features

Detect and mitigate CVE-2023-25663 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →