CVE-2023-25661

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-25661

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25661.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-25661

Aliases

Downstream

AZL-31197

Published

2023-03-27T19:52:07.826Z

Modified

2026-08-12T13:32:26.641059Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Denial of Service in TensorFlow

Details

TensorFlow is an Open Source Machine Learning Framework. In versions prior to 2.11.1 a malicious invalid input crashes a tensorflow model (Check Failed) and can be used to trigger a denial of service attack. A proof of concept can be constructed with the Convolution3DTranspose function. This Convolution3DTranspose layer is a very common API in modern neural networks. The ML models containing such vulnerable components could be deployed in ML applications or as cloud services. This failure could be potentially used to trigger a denial of service attack on ML cloud services. An attacker must have privilege to provide input to a Convolution3DTranspose call. This issue has been patched and users are advised to upgrade to version 2.11.1. There are no known workarounds for this vulnerability.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25661.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20"
    ]
}

References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type

GIT

Repo

https://github.com/tensorflow/tensorflow

Events

Introduced

Fixed

a3e2c692c18649329c4210cf8df2487d2028e267

Fixed

948fe6369a5711d4b4568ea9bbf6015c6dfb77e2

Database specific

Show details

{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.11.1"
        }
    ]
}

Affected versions

0.*

0.5.0

0.6.0

v1.*

v1.1.0-rc1

v1.1.0-rc2

v1.12.1

v1.6.0-rc1

v1.9.0-rc2

v2.*

v2.11.0

v2.11.0-rc0

v2.11.0-rc1

v2.11.0-rc2

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "285309628880902168625313617424043651742",
                "239535372138245330417835353361299741620",
                "158801968505074405078757916969222784862",
                "168056033078274205017724107214629010723"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2023-25661-867d37c7",
        "target": {
            "file": "tensorflow/core/kernels/conv_grad_ops_3d.cc"
        },
        "source": "https://github.com/tensorflow/tensorflow/commit/948fe6369a5711d4b4568ea9bbf6015c6dfb77e2",
        "signature_version": "v1"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25661.json"

vanir_signatures_modified

"2026-08-12T13:32:26Z"