PT-2020-14325 · Google · Tensorflow
Mihaimaruseac
·
Published
2020-10-21
·
Updated
2024-03-06
·
CVE-2020-15265
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
TensorFlow versions prior to 2.4.0
Description
The issue allows an attacker to pass an invalid
axis value to tf.quantization.quantize and dequantize, resulting in accessing a dimension outside the rank of the input tensor in the C++ kernel implementation. This occurs because dim size only performs a DCHECK to validate the argument, which is a no-op in normal builds, leading to a segfault and out-of-bounds access of an array.Recommendations
For TensorFlow versions prior to 2.4.0, update to TensorFlow 2.4.0 or use a TensorFlow nightly package released after the patch commit eccb7ec454e6617738554a255d77f08e60ee0808 to resolve the issue. As a temporary workaround, consider validating the
axis value before passing it to tf.quantization.quantize and dequantize to prevent out-of-bounds access.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Tensorflow