PT-2020-14269 · Google · Tensorflow

Mihaimaruseac · Published 2020-09-25 · Updated 2024-03-06 · CVE-2020-15198

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 2.3.1

Description The SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor, specifically that the indices tensor has the same shape as the values one. This can result in accesses outside the bounds of heap allocated buffers due to a shape mismatch, as the values in these tensors are always accessed in parallel.

Recommendations For versions prior to 2.3.1, upgrade to TensorFlow 2.3.1 to resolve the issue. As a temporary workaround, consider validating the shape of the indices and values tensors before passing them to the SparseCountSparseOutput implementation to prevent shape mismatches.

Exploit

Fix

Buffer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-119

CWE-122

Related Identifiers

BIT-TENSORFLOW-2020-15198

CVE-2020-15198

GHSA-JC87-6VPP-7FF3

PYSEC-2020-121

PYSEC-2020-278

PYSEC-2020-313

Affected Products

Tensorflow

References · 14

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-jc87-6vpp-7ff3 · Exploit
• https://github.com/tensorflow/tensorflow/commit/3cbb917b4714766030b28eba9fb41bb97ce9ee02 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15198 · Security Note
• https://osv.dev/vulnerability/BIT-tensorflow-2020-15198 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-121 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-278 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15198 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-313 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jc87-6vpp-7ff3 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-121.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-313.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-278.yaml · Note