PT-2020-16392 · Google · Tensorflow

Mihaimaruseac · Published 2020-12-10 · Updated 2024-03-06 · CVE-2020-26269

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions TensorFlow versions 2.4.0rc*

Description The general implementation for matching filesystem paths to globbing pattern in TensorFlow is vulnerable to an access out of bounds of the array holding the directories. This issue arises due to unverified invariants and preconditions in the parallel implementation of GetMatchingPaths. The vulnerability can cause a crash due to an out of bounds read under certain scenarios, such as when using tf.io.gfile.glob('/tmp/x/') on a directory containing a single file.

Recommendations For TensorFlow versions 2.4.0rc*, update to version 2.4.0 to resolve the issue. As a temporary workaround, consider avoiding the use of tf.io.gfile.glob() on directories with specific patterns that may trigger the out of bounds access until the patch is applied.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BIT-TENSORFLOW-2020-26269

CVE-2020-26269

GHSA-9JJW-HF72-3MXW

PYSEC-2020-141

PYSEC-2020-300

PYSEC-2020-335

Affected Products

Tensorflow

References · 24

• 🔥 https://github.com/tensorflow/tensorflow/security/advisories/GHSA-9jjw-hf72-3mxw · Exploit
• https://github.com/tensorflow/tensorflow/commit/8b5b9dc96666a3a5d27fad7179ff215e3b74b67c · Patch
• https://osv.dev/vulnerability/PYSEC-2020-335 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-300 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9jjw-hf72-3mxw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26269 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26269 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-tensorflow-2020-26269 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-141 · Vendor Advisory
• https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L106 · Note
• https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L127 · Note
• https://github.com/tensorflow/tensorflow/pull/44310 · Note
• https://github.com/tensorflow/tensorflow/pull/40861 · Note
• https://github.com/tensorflow/tensorflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-141.yaml · Note