CVE-2023-25674: 
Python vulnerability analysis and mitigation

TensorFlow, an open source machine learning platform, was found to contain a vulnerability (CVE-2023-25674) in versions prior to 2.12.0 and 2.11.1. The vulnerability manifests as a null pointer error in the RandomShuffle operation when XLA (Accelerated Linear Algebra) is enabled (TF Advisory, NVD).

The vulnerability is characterized by a null pointer error that occurs specifically when using the RandomShuffle operation with XLA compilation enabled. The issue can be triggered when specific parameters are passed to the RandomShuffle operation, including extreme values such as seed parameters. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can lead to application crashes due to the null pointer dereference, potentially causing denial of service in applications using TensorFlow's RandomShuffle operation with XLA enabled (TF Advisory).

The vulnerability can be triggered by passing specific parameters to the RandomShuffle operation, including a value of 1e+20 and specific seed values (-4294967297, -2147483649) when XLA compilation is enabled (TF Advisory).

The vulnerability has been patched in TensorFlow versions 2.12.0 and 2.11.1. Users are advised to upgrade to these or later versions to mitigate the issue. The fix was implemented in commit 728113a3be690facad6ce436660a0bc1858017fa (TF Commit).