PT-2020-14271 · Google · Tensorflow
Mihaimaruseac
·
Published
2020-09-25
·
Updated
2024-03-06
·
CVE-2020-15200
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Tensorflow versions prior to 2.3.1
Description
The
RaggedCountSparseOutput implementation does not validate that the input arguments form a valid ragged tensor, specifically that the values in the splits tensor generate a valid partitioning of the values tensor. This can cause a heap buffer overflow. A BatchedMap is equivalent to a vector where each element is a hashmap, but if the first element of splits values is not 0, batch idx will never be 1, resulting in no hashmap at index 0 in per batch counts and potentially causing a segmentation fault when accessed.Recommendations
For versions prior to 2.3.1, upgrade to TensorFlow 2.3.1 to resolve the issue. As a temporary workaround, consider avoiding the use of the
RaggedCountSparseOutput implementation until the issue is resolved. Restrict access to the splits and values tensors to minimize the risk of exploitation. Avoid using the batch idx variable in the affected code until the issue is resolved.Exploit
Fix
Memory Corruption
RCE
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tensorflow