VYPR
High severityNVD Advisory· Published Mar 24, 2023· Updated Feb 19, 2025

TensorFlow has Floating Point Exception in AudioSpectrogram

CVE-2023-25666

Description

TensorFlow is an open source platform for machine learning. Prior to versions 2.12.0 and 2.11.1, there is a floating point exception in AudioSpectrogram. A fix is included in TensorFlow version 2.12.0 and version 2.11.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
tensorflowPyPI
< 2.11.12.11.1
tensorflow-cpuPyPI
< 2.11.12.11.1
tensorflow-gpuPyPI
< 2.11.12.11.1

Affected products

1

Patches

1
d0d4e779da0d

Fix audio spectrogram FPE.

https://github.com/tensorflow/tensorflowAntonio SanchezJan 20, 2023via ghsa
3 files changed · +52 0
  • tensorflow/core/kernels/BUILD+1 0 modified
    @@ -5922,6 +5922,7 @@ tf_cuda_cc_test(
             "//tensorflow/core:test",
             "//tensorflow/core:test_main",
             "//tensorflow/core:testlib",
    +        "//tensorflow/core/platform:status_matchers",
         ],
     )
     
    
  • tensorflow/core/kernels/spectrogram_op_test.cc+41 0 modified
    @@ -19,6 +19,8 @@ limitations under the License.
     #include <memory>
     #include <vector>
     
    +#include <gmock/gmock.h>
    +#include <gtest/gtest.h>
     #include "tensorflow/cc/client/client_session.h"
     #include "tensorflow/cc/ops/audio_ops.h"
     #include "tensorflow/cc/ops/const_op.h"
    @@ -29,6 +31,9 @@ limitations under the License.
     #include "tensorflow/core/kernels/ops_util.h"
     #include "tensorflow/core/lib/core/status_test_util.h"
     #include "tensorflow/core/platform/test.h"
    +#include "tensorflow/tsl/lib/core/status_test_util.h"
    +#include "tensorflow/tsl/platform/errors.h"
    +#include "tensorflow/tsl/platform/status_matchers.h"
     
     namespace tensorflow {
     namespace ops {
    @@ -140,6 +145,42 @@ TEST(SpectrogramOpTest, MultichannelTest) {
       }
     }
     
    +TEST(SpectrogramOpTest, InvalidWindowSize) {
    +  Scope root = Scope::NewRootScope();
    +  const int audio_size = 8;
    +  const int channel_size = 2;
    +  Tensor audio_tensor(DT_FLOAT, TensorShape({audio_size, channel_size}));
    +  test::FillValues<float>(
    +      &audio_tensor, {-1.0f, -1.0f, 0.0f, 0.0f, 1.0f, 1.0f, 0.0f, 0.0f, -1.0f,
    +                      -1.0f, 0.0f, 0.0f, 1.0f, 1.0f, 0.0f, 0.0f});
    +  Output audio_const_op = Const(root.WithOpName("audio_const_op"),
    +                                Input::Initializer(audio_tensor));
    +  AudioSpectrogram spectrogram_op =
    +      AudioSpectrogram(root.WithOpName("spectrogram_op"), audio_const_op,
    +                       /*window_size=*/1, /*stride=*/1);
    +  EXPECT_THAT(root.status(),
    +              tsl::testing::StatusIs(tsl::error::Code::INVALID_ARGUMENT,
    +                                     ::testing::ContainsRegex("window size")));
    +}
    +
    +TEST(SpectrogramOpTest, InvalidStride) {
    +  Scope root = Scope::NewRootScope();
    +  const int audio_size = 8;
    +  const int channel_size = 2;
    +  Tensor audio_tensor(DT_FLOAT, TensorShape({audio_size, channel_size}));
    +  test::FillValues<float>(
    +      &audio_tensor, {-1.0f, -1.0f, 0.0f, 0.0f, 1.0f, 1.0f, 0.0f, 0.0f, -1.0f,
    +                      -1.0f, 0.0f, 0.0f, 1.0f, 1.0f, 0.0f, 0.0f});
    +  Output audio_const_op = Const(root.WithOpName("audio_const_op"),
    +                                Input::Initializer(audio_tensor));
    +  AudioSpectrogram spectrogram_op =
    +      AudioSpectrogram(root.WithOpName("spectrogram_op"), audio_const_op,
    +                       /*window_size=*/2, /*stride=*/0);
    +  EXPECT_THAT(root.status(),
    +              tsl::testing::StatusIs(tsl::error::Code::INVALID_ARGUMENT,
    +                                     ::testing::ContainsRegex("stride")));
    +}
    +
     }  // namespace
     }  // namespace ops
     }  // namespace tensorflow
    
  • tensorflow/core/ops/audio_ops.cc+10 0 modified
    @@ -17,6 +17,7 @@ limitations under the License.
     #include "tensorflow/core/framework/op.h"
     #include "tensorflow/core/framework/shape_inference.h"
     #include "tensorflow/core/lib/core/bits.h"
    +#include "tensorflow/core/platform/errors.h"
     
     namespace tensorflow {
     
    @@ -72,8 +73,17 @@ Status SpectrogramShapeFn(InferenceContext* c) {
       TF_RETURN_IF_ERROR(c->WithRank(c->input(0), 2, &input));
       int32_t window_size;
       TF_RETURN_IF_ERROR(c->GetAttr("window_size", &window_size));
    +  if (window_size <= 1) {
    +    return errors::InvalidArgument("window size must be > 1, got ",
    +                                   window_size);
    +  }
    +
       int32_t stride;
       TF_RETURN_IF_ERROR(c->GetAttr("stride", &stride));
    +  if (stride <= 0) {
    +    return errors::InvalidArgument("stride must be strictly positive, got ",
    +                                   stride);
    +  }
     
       DimensionHandle input_length = c->Dim(input, 0);
       DimensionHandle input_channels = c->Dim(input, 1);
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.