PT-2020-14268 · Google · Tensorflow

Mihaimaruseac · Published 2020-09-25 · Updated 2024-03-06 · CVE-2020-15197

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tensorflow versions prior to 2.3.1

Description The SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor, specifically that the indices tensor has rank 2, which must be a matrix. Malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash, potentially causing denial of service in serving installations if users are allowed to control the components of the input sparse tensor.

Recommendations For versions prior to 2.3.1, upgrade to TensorFlow 2.3.1 to resolve the issue. As a temporary workaround, consider restricting access to the SparseCountSparseOutput implementation to minimize the risk of exploitation. Avoid allowing users to control the components of the input sparse tensor until the issue is resolved.

Exploit

Fix

Assertion Failure

RCE

Weakness Enumeration

CWE-617

CWE-20

Related Identifiers

BIT-TENSORFLOW-2020-15197

CVE-2020-15197

GHSA-QC53-44CJ-VFVX

PYSEC-2020-120

PYSEC-2020-277

PYSEC-2020-312

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-qc53-44cj-vfvx · Exploit
• https://github.com/tensorflow/tensorflow/commit/3cbb917b4714766030b28eba9fb41bb97ce9ee02 · Patch
• https://osv.dev/vulnerability/CVE-2020-15197 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qc53-44cj-vfvx · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-277 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15197 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-312 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-120 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2020-15197 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-277.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-312.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-120.yaml · Note