PT-2020-14279 · Google+1 · Tensorflow+1

Published 2020-09-25 · Updated 2024-03-06 · CVE-2020-15208

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions prior to 1.15.4 TensorFlow versions prior to 2.0.3 TensorFlow versions prior to 2.1.2 TensorFlow versions prior to 2.2.1 TensorFlow versions prior to 2.3.1

Description The issue arises when determining the common dimension size of two tensors. TFLite uses a DCHECK which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor, resulting in reads/writes outside of bounds.

Recommendations Upgrade to TensorFlow 1.15.4 or later Upgrade to TensorFlow 2.0.3 or later Upgrade to TensorFlow 2.1.2 or later Upgrade to TensorFlow 2.2.1 or later Upgrade to TensorFlow 2.3.1 or later

Exploit

Fix

Memory Corruption

Out of bounds Read

Weakness Enumeration

CWE-787

CWE-125

Related Identifiers

BIT-TENSORFLOW-2020-15208

CVE-2020-15208

GHSA-MXJJ-953W-2C2V

OPENSUSE-SU-2020:1766-1

OPENSUSE-SU-2020_1766-1

OPENSUSE-SU-2024:12116-1

PYSEC-2020-131

PYSEC-2020-288

PYSEC-2020-323

Affected Products

Suse

Tensorflow

References · 37

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-mxjj-953w-2c2v · Exploit
• https://github.com/tensorflow/tensorflow/commit/8ee24e7949a203d234489f9da2c5bf45a7d5157d · Patch
• https://osv.dev/vulnerability/GHSA-mxjj-953w-2c2v · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1766-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2020-15208 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-323 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15208 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-131 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-288 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15208 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-323.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-131.yaml · Note