Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-25663

CVE-2023-25663: TensorFlow has Null Pointer Error in TensorArrayConcatV2

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-25663
GHSA ID
GHSA-64jg-wjww-7c5w
EPSS Score
0.34151%
CWE
CWE-476
Published
3/24/2023
Updated
3/27/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
tensorflowpip< 2.11.12.11.1
tensorflow-cpupip< 2.11.12.11.1
tensorflow-gpupip< 2.11.12.11.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the unvalidated use of ctx->step_container() in GetTensorArray. The original code path (pre-patch) directly executed ctx->step_container()->Lookup(...) without null checking. The patch adds a null check for ScopedStepContainer* sc = ctx->step_container(), confirming this was the vulnerable code path. The CWE-476 classification and crash scenario described in the advisory directly map to this unchecked pointer dereference.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t W**n *tx->st*p_*ont*int*r() is * null ptr, t** Lookup *un*tion will ** *x**ut** wit* * null point*r. ```pyt*on import t*nsor*low *s t* t*.r*w_ops.T*nsor*rr*y*on**tV*(**n*l*=['*', '*'], *low_in = *.*, *typ*=t*.int**, *l*m*nt_s**p*_*x**pt*=*

Reasoning

T** vuln*r**ility st*ms *rom t** unv*li**t** us* o* *tx->st*p_*ont*in*r() in **tT*nsor*rr*y. T** ori*in*l *o** p*t* (pr*-p*t**) *ir**tly *x**ut** *tx->st*p_*ont*in*r()->Lookup(...) wit*out null ****kin*. T** p*t** ***s * null ****k *or S*op**St*p*ont