PT-2020-14275 · Google+1 · Tensorflow+1

Published 2020-09-25 · Updated 2024-03-06 · CVE-2020-15204

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 1.15.4 TensorFlow versions prior to 2.0.3 TensorFlow versions prior to 2.1.2 TensorFlow versions prior to 2.2.1 TensorFlow versions prior to 2.3.1

Description In eager mode, TensorFlow does not set the session state, resulting in a null pointer dereference when calling tf.raw ops.GetSessionHandle or tf.raw ops.GetSessionHandleV2. This occurs because ctx->session state() returns nullptr and the code immediately dereferences it, causing a segmentation fault.

Recommendations Upgrade to TensorFlow version 1.15.4 or later Upgrade to TensorFlow version 2.0.3 or later Upgrade to TensorFlow version 2.1.2 or later Upgrade to TensorFlow version 2.2.1 or later Upgrade to TensorFlow version 2.3.1 or later

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-TENSORFLOW-2020-15204

CVE-2020-15204

GHSA-Q8GV-Q7WR-9JF8

OPENSUSE-SU-2020:1766-1

OPENSUSE-SU-2020_1766-1

OPENSUSE-SU-2024:12116-1

PYSEC-2020-127

PYSEC-2020-284

PYSEC-2020-319

Affected Products

Suse

Tensorflow

References · 37

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-q8gv-q7wr-9jf8 · Exploit
• https://github.com/tensorflow/tensorflow/commit/9a133d73ae4b4664d22bd1aa6d654fec13c52ee1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15204 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-319 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q8gv-q7wr-9jf8 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-284 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1766-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-127 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15204 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2020-15204 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-319.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-127.yaml · Note