AVID-2026-R1201

Description

TensorFlow has Floating Point Exception in AvgPoolGrad with XLA (CVE-2023-25669)

Details

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, if the stride and window size are not positive for tf.raw_ops.AvgPoolGrad, it can give a floating point exception. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

Reason for inclusion in AVID: CVE-2023-25669 is a vulnerability in TensorFlow (an AI framework) causing a floating point exception in AvgPoolGrad with XLA. TensorFlow is a core component used to build/train/deploy general-purpose AI systems, making this a software supply-chain vulnerability in AI stacks. It is AI-related, in-scope for GP AI supply chains (dependencies/serving), qualifies as a security/safety vulnerability (availability impact), and the CVE/NVD provides explicit signal. Therefore, it should be kept for AVID curation.

References

Affected or Relevant Artifacts

Developer: tensorflow
Deployer: tensorflow
Artifact Details:

Type	Name
System	tensorflow

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score	7.5
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	🔴 High

CWE

ID	Description
CWE-697	CWE-697: Incorrect Comparison

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-03-24
Version: 0.3.3
AVID Entry