High severityNVD Advisory· Published Mar 24, 2023· Updated Feb 19, 2025
TensorFlow has Floating Point Exception in AudioSpectrogram
CVE-2023-25666
Description
TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a floating point exception in AudioSpectrogram. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
tensorflowPyPI | < 2.11.1 | 2.11.1 |
tensorflow-cpuPyPI | < 2.11.1 | 2.11.1 |
tensorflow-gpuPyPI | < 2.11.1 | 2.11.1 |
Affected products
1- Range: < 2.11.1
Patches
1d0d4e779da0dFix audio spectrogram FPE.
3 files changed · +52 −0
tensorflow/core/kernels/BUILD+1 −0 modified@@ -5922,6 +5922,7 @@ tf_cuda_cc_test( "//tensorflow/core:test", "//tensorflow/core:test_main", "//tensorflow/core:testlib", + "//tensorflow/core/platform:status_matchers", ], )
tensorflow/core/kernels/spectrogram_op_test.cc+41 −0 modified@@ -19,6 +19,8 @@ limitations under the License. #include <memory> #include <vector> +#include <gmock/gmock.h> +#include <gtest/gtest.h> #include "tensorflow/cc/client/client_session.h" #include "tensorflow/cc/ops/audio_ops.h" #include "tensorflow/cc/ops/const_op.h" @@ -29,6 +31,9 @@ limitations under the License. #include "tensorflow/core/kernels/ops_util.h" #include "tensorflow/core/lib/core/status_test_util.h" #include "tensorflow/core/platform/test.h" +#include "tensorflow/tsl/lib/core/status_test_util.h" +#include "tensorflow/tsl/platform/errors.h" +#include "tensorflow/tsl/platform/status_matchers.h" namespace tensorflow { namespace ops { @@ -140,6 +145,42 @@ TEST(SpectrogramOpTest, MultichannelTest) { } } +TEST(SpectrogramOpTest, InvalidWindowSize) { + Scope root = Scope::NewRootScope(); + const int audio_size = 8; + const int channel_size = 2; + Tensor audio_tensor(DT_FLOAT, TensorShape({audio_size, channel_size})); + test::FillValues<float>( + &audio_tensor, {-1.0f, -1.0f, 0.0f, 0.0f, 1.0f, 1.0f, 0.0f, 0.0f, -1.0f, + -1.0f, 0.0f, 0.0f, 1.0f, 1.0f, 0.0f, 0.0f}); + Output audio_const_op = Const(root.WithOpName("audio_const_op"), + Input::Initializer(audio_tensor)); + AudioSpectrogram spectrogram_op = + AudioSpectrogram(root.WithOpName("spectrogram_op"), audio_const_op, + /*window_size=*/1, /*stride=*/1); + EXPECT_THAT(root.status(), + tsl::testing::StatusIs(tsl::error::Code::INVALID_ARGUMENT, + ::testing::ContainsRegex("window size"))); +} + +TEST(SpectrogramOpTest, InvalidStride) { + Scope root = Scope::NewRootScope(); + const int audio_size = 8; + const int channel_size = 2; + Tensor audio_tensor(DT_FLOAT, TensorShape({audio_size, channel_size})); + test::FillValues<float>( + &audio_tensor, {-1.0f, -1.0f, 0.0f, 0.0f, 1.0f, 1.0f, 0.0f, 0.0f, -1.0f, + -1.0f, 0.0f, 0.0f, 1.0f, 1.0f, 0.0f, 0.0f}); + Output audio_const_op = Const(root.WithOpName("audio_const_op"), + Input::Initializer(audio_tensor)); + AudioSpectrogram spectrogram_op = + AudioSpectrogram(root.WithOpName("spectrogram_op"), audio_const_op, + /*window_size=*/2, /*stride=*/0); + EXPECT_THAT(root.status(), + tsl::testing::StatusIs(tsl::error::Code::INVALID_ARGUMENT, + ::testing::ContainsRegex("stride"))); +} + } // namespace } // namespace ops } // namespace tensorflow
tensorflow/core/ops/audio_ops.cc+10 −0 modified@@ -17,6 +17,7 @@ limitations under the License. #include "tensorflow/core/framework/op.h" #include "tensorflow/core/framework/shape_inference.h" #include "tensorflow/core/lib/core/bits.h" +#include "tensorflow/core/platform/errors.h" namespace tensorflow { @@ -72,8 +73,17 @@ Status SpectrogramShapeFn(InferenceContext* c) { TF_RETURN_IF_ERROR(c->WithRank(c->input(0), 2, &input)); int32_t window_size; TF_RETURN_IF_ERROR(c->GetAttr("window_size", &window_size)); + if (window_size <= 1) { + return errors::InvalidArgument("window size must be > 1, got ", + window_size); + } + int32_t stride; TF_RETURN_IF_ERROR(c->GetAttr("stride", &stride)); + if (stride <= 0) { + return errors::InvalidArgument("stride must be strictly positive, got ", + stride); + } DimensionHandle input_length = c->Dim(input, 0); DimensionHandle input_channels = c->Dim(input, 1);
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-f637-vh3r-vfh2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-25666ghsaADVISORY
- github.com/tensorflow/tensorflow/commit/d0d4e779da0d0f56499c6fa5ba09f0a576cc6b14ghsax_refsource_MISCWEB
- github.com/tensorflow/tensorflow/security/advisories/GHSA-f637-vh3r-vfh2ghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.