CVE-2023-25801

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2023-25801

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25801.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2023-25801

Aliases

Downstream

AZL-31206

AZL-35322

Published

2023-03-24T23:08:50.251Z

Modified

2026-07-21T23:25:24.135872Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H CVSS Calculator

Summary

TensorFlow has double free in Fractional(Max/Avg)Pool

Details

TensorFlow is an open source machine learning platform. Prior to versions 2.12.0 and 2.11.1, nn_ops.fractional_avg_pool_v2 and nn_ops.fractional_max_pool_v2 require the first and fourth elements of their parameter pooling_ratio to be equal to 1.0, as pooling on batch and channel dimensions is not supported. A fix is included in TensorFlow 2.12.0 and 2.11.1.

Database specific

{
    "cwe_ids": [
        "CWE-415"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25801.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/tensorflow/tensorflow

Affected ranges

Type

GIT

Repo

https://github.com/tensorflow/tensorflow

Events

Introduced

Fixed

0db597d0d758aba578783b5bf46c889700a45085

Fixed

ee50d1e00f81f62a4517453f721c634bbb478307

Database specific

{
    "cpe": "cpe:2.3:a:google:tensorflow:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.12.0"
        }
    ]
}

Affected versions

0.*

0.5.0

0.6.0

v1.*

v1.1.0-rc1

v1.1.0-rc2

v1.12.1

v1.6.0-rc1

v1.9.0-rc2

v2.*

v2.12.0-rc0

v2.12.0-rc1

Database specific

vanir_signatures_modified

"2026-07-21T23:25:24Z"

vanir_signatures

[
    {
        "signature_type": "Line",
        "target": {
            "file": "tensorflow/core/kernels/fractional_max_pool_op.cc"
        },
        "deprecated": false,
        "source": "https://github.com/tensorflow/tensorflow/commit/ee50d1e00f81f62a4517453f721c634bbb478307",
        "id": "CVE-2023-25801-2caca80f",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "34546913169249889525886542189940177315",
                "310058432396153943507607782147984202057",
                "28330422912176358397732124755806312902",
                "165140376298228359518267396930023748282"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "tensorflow/core/kernels/fractional_avg_pool_op.cc"
        },
        "deprecated": false,
        "source": "https://github.com/tensorflow/tensorflow/commit/ee50d1e00f81f62a4517453f721c634bbb478307",
        "id": "CVE-2023-25801-8bafb306",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "34546913169249889525886542189940177315",
                "59923946579509533237764873892347732726",
                "309690233085764761772992873851803466967",
                "3373865295338081207686420620641604317"
            ],
            "threshold": 0.9
        }
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25801.json"