AVID-2026-R1205

Description

TensorFlow has Floating Point Exception in TensorListSplit with XLA (CVE-2023-25673)

Details

TensorFlow is an open source platform for machine learning. Versions prior to 2.12.0 and 2.11.1 have a Floating Point Exception in TensorListSplit with XLA. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

Reason for inclusion in AVID: CVE-2023-25673 describes a vulnerability in TensorFlow (a core ML framework) causing a floating point exception in TensorListSplit with XLA in affected versions. This is a software vulnerability in a widely used ML stack, impacting AI systems built on TensorFlow. It affects software supply chain components (TensorFlow library/dependencies) used to train/serve AI systems. It is security-related (availability impact) with CVSS high, and there is explicit evidence in CVE/NVD references. Sufficient evidence from CVE entry and vendor advisory links.

References

Affected or Relevant Artifacts

Developer: tensorflow
Deployer: tensorflow
Artifact Details:

Type	Name
System	tensorflow

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score	7.5
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	🔴 High

CWE

ID	Description
CWE-697	CWE-697: Incorrect Comparison

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-03-24
Version: 0.3.3
AVID Entry