7.5

CVSS Score

3.1

Basic Information

CVE ID

CVE-2023-25674

GHSA ID

GHSA-gf97-q72m-7579

EPSS Score

0.49333%

CWE

CWE-476

Published

3/24/2023

Updated

3/30/2023

KEV Status

Technology

Python

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2023-25674

CVE-2023-25674: TensorFlow has Null Pointer Error in RandomShuffle with XLA enable

Impact

NPE in RandomShuffle with XLA enable

import tensorflow as tf

func = tf.raw_ops.RandomShuffle
para = {'value': 1e+20, 'seed': -4294967297, 'seed2': -2147483649}

@tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()

Patches

We have patched the issue in GitHub commit 728113a3be690facad6ce436660a0bc1858017fa.

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by r3pwnx

(GitHub Advisory)

7.5

CVSS Score

3.1

Basic Information

CVE ID

CVE-2023-25674

GHSA ID

GHSA-gf97-q72m-7579

EPSS Score

0.49333%

CWE

CWE-476

Published

3/24/2023

Updated

3/30/2023

KEV Status

Technology

Python

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tensorflow	pip	< 2.11.1	2.11.1
tensorflow-cpu	pip	< 2.11.1	2.11.1
tensorflow-gpu	pip	< 2.11.1	2.11.1

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The commit diff shows the vulnerability was fixed by adding validation for positive lengths in TensorListSplitOp. Though the user-facing API was RandomShuffle, the underlying XLA implementation path for tensor list handling (specifically TensorListSplitOp) was the root cause. The test case demonstrates how invalid parameters could trigger this code path, and the patch adds explicit checks to prevent zero/negative lengths.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t NP* in R*n*omS*u**l* wit* XL* *n**l* ```pyt*on import t*nsor*low *s t* *un* = t*.r*w_ops.R*n*omS*u**l* p*r* = {'v*lu*': **+**, 's***': -**********, 's****': -**********} @t*.*un*tion(jit_*ompil*=Tru*) *** t*st(): y = *un*(**p*r*)

Reasoning

T** *ommit *i** s*ows t** vuln*r**ility w*s *ix** *y ***in* v*li**tion *or positiv* l*n*t*s in T*nsorListSplitOp. T*ou** t** us*r-***in* *PI w*s R*n*omS*u**l*, t** un**rlyin* XL* impl*m*nt*tion p*t* *or t*nsor list **n*lin* (sp**i*i**lly T*nsorListSp

7.5

Basic Information

Concerned about an active attack path?

CVE-2023-25674: TensorFlow has Null Pointer Error in RandomShuffle with XLA enable

Impact

Patches

For more information

Attribution

7.5

Basic Information

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability Intelligence
Miggo AI