AVID-2026-R1208

Description

TensorFlow has null dereference on ParallelConcat with XLA (CVE-2023-25676)

Details

TensorFlow is an open source machine learning platform. When running versions prior to 2.12.0 and 2.11.1 with XLA, tf.raw_ops.ParallelConcat segfaults with a nullptr dereference when given a parameter shape with rank that is not greater than zero. A fix is available in TensorFlow 2.12.0 and 2.11.1.

Reason for inclusion in AVID: CVE-2023-25676 describes a NULL pointer dereference vulnerability in TensorFlow when using XLA with ParallelConcat. TensorFlow is a core AI framework used to build/train/deploy AI systems, so this is a software supply chain issue within the AI software stack. The CVE provides affected versions, fixes, and CVSS details, giving sufficient evidence that it is a security vulnerability impacting AI pipelines.

References

Affected or Relevant Artifacts

Developer: tensorflow
Deployer: tensorflow
Artifact Details:

Type	Name
System	tensorflow

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.1
Vector String	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score	7.5
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	🔴 High

CWE

ID	Description
CWE-476	CWE-476: NULL Pointer Dereference

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-03-24
Version: 0.3.3
AVID Entry