PT-2020-14277 · Google+1 · Tensorflow+1

Shuaike Dong · Published 2020-09-25 · Updated 2024-03-06 · CVE-2020-15206

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 1.15.4 TensorFlow versions prior to 2.0.3 TensorFlow versions prior to 2.1.2 TensorFlow versions prior to 2.2.1 TensorFlow versions prior to 2.3.1

Description Changing the TensorFlow's SavedModel protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using tensorflow-serving or other inference-as-a-service installments.

Recommendations Upgrade to TensorFlow 1.15.4 Upgrade to TensorFlow 2.0.3 Upgrade to TensorFlow 2.1.2 Upgrade to TensorFlow 2.2.1 Upgrade to TensorFlow 2.3.1

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-TENSORFLOW-2020-15206

CVE-2020-15206

GHSA-W5GH-2WR2-PM6G

OPENSUSE-SU-2020:1766-1

OPENSUSE-SU-2020_1766-1

OPENSUSE-SU-2024:12116-1

PYSEC-2020-129

PYSEC-2020-286

PYSEC-2020-321

Affected Products

Suse

Tensorflow

References · 40

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-w5gh-2wr2-pm6g · Exploit
• https://github.com/tensorflow/tensorflow/commit/adf095206f25471e864a8e63a0f1caef53a0e3a6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15206 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-321 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-129 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-286 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1766-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w5gh-2wr2-pm6g · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2020-15206 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1 · Note
• https://github.com/tensorflow/tensorflow/commit/f760f88b4267d981e13f4b302c437ae800445968 · Note
• https://github.com/tensorflow/tensorflow/commit/fcfef195637c6e365577829c4d67681695956e7d · Note
• https://github.com/tensorflow/tensorflow · Note