PT-2019-14829 · Google · Tensorflow

Mihaimaruseac · Publicado 2019-12-16 · Atualizado 2021-10-29 · CVE-2019-16778

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 1.15 TensorFlow versions prior to 2.0

Description A heap buffer overflow in UnsortedSegmentSum can occur when the Index template argument is int32, causing data size and num segments fields to be truncated from int64 to int32, potentially resulting in accessing out of bounds heap memory. This issue is unlikely to be exploitable and was detected and fixed internally.

Recommendations For versions prior to 1.15, update to TensorFlow 1.15 or later. For versions prior to 2.0, update to TensorFlow 2.0 or later.

Correção

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-122

CWE-681

Identificadores relacionados

CVE-2019-16778

GHSA-844W-J86R-4X2J

PYSEC-2019-209

PYSEC-2019-227

PYSEC-2019-234

Produtos afetados

Tensorflow

Referências · 13

• https://github.com/tensorflow/tensorflow/security/advisories/GHSA-844w-j86r-4x2j · Correção
• https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2019-002.md · Nota
• https://github.com/tensorflow/tensorflow/commit/db4f9717c41bccc3ce10099ab61996b246099892 · Correção
• https://github.com/tensorflow/tensorflow · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2019-234.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2019-209.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2019-227.yaml · Nota
• https://osv.dev/vulnerability/PYSEC-2019-234 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-209 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-16778 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-16778 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2019-227 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-844w-j86r-4x2j · Aviso do Fabricante