Vulnerability · Published Mar 24, 2023 · Assigned by GitHub_M
CVE-2023-25801TensorFlow has double free in Fractional(Max/Avg)Pool
High 8.0
In plain English
A high-severity double free in tensorflow from tensorflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, `nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | tensorflow | 2.11.1 | GHSA-f49c-87jh-g47q |
| PyPI | tensorflow | 2.11.1 | PYSEC-2026-3166 |
| PyPI | tensorflow-cpu | 2.11.1 | GHSA-f49c-87jh-g47q |
| PyPI | tensorflow-cpu | 2.11.1 | PYSEC-2026-3314 |
| PyPI | tensorflow-gpu | 2.11.1 | GHSA-f49c-87jh-g47q |
| PyPI | tensorflow-gpu | 2.11.1 | PYSEC-2026-985 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tensorflow | tensorflow | < 2.11.1 |
Weakness: CWE-415 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H