Uncaught Exception in TensorFlow - CVE-2023-25670

Vulnerability identifier: #VU73844

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-25670

CWE-ID: CWE-248

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a floating point exception in  QuantizedMatMulWithBiasAndDequantize. A remote attacker can pass specially crafted input to the application, trigger an unhanded exception and perform a denial of service (DoS) attack.

TensorFlow
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Machine Learning on CP4D
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Robotic Process Automation
IBM Watson Machine Learning Accelerator
Watson Studio on Cloud Pak for Data
Maximo Application Suite - Monitor Component
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

TensorFlow - update to 2.11.1
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Watson Machine Learning on CP4D - update to 4.8
IBM Watson Machine Learning Accelerator - update to 4.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.7
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
Watson Studio on Cloud Pak for Data - update to 4.8.0
Maximo Application Suite - Monitor Component - addressed in versions 8.10.9, 8.11.6
IBM Robotic Process Automation - addressed in versions 21.0.7.8, 23.0.9
Robotic Process Automation for Cloud Pak - addressed in versions 21.0.7.8, 23.0.9

• https://github.com/tensorflow/tensorflow/releases/tag/v2.11.1
• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-49rq-hwc3-x77w

• Multiple vulnerabilities in TensorFlow
• Uncaught exception in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Robotic Process Automation
• Multiple vulnerabilities in IBM Watson Discovery Cartridge for IBM Cloud Pak for Data
• IBM Watson Machine Learning on Cloud Pak for Data update for Tensorflow
• Multiple vulnerabilities in IBM Watson Studio on Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• Multiple vulnerabilities in IBM Maximo Application Suite - Monitor Component