CVE-2020-15200: Heap Buffer Overflow in TensorFlow
Summary
CVE-2020-15200: Segfault in Tensorflow. Affects tensorflow versions >= 2.3.0, < 2.3.1. Fixed in 2.3.1. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · PyPI
The same CVE-2020-15200 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow allows users to create and manipulate tensors, which are multi-dimensional arrays used as the fundamental data structure for computations in machine learning. This vulnerability affects TensorFlow versions prior to 2.3.1.
Vulnerability Detail
The vulnerability (CVE-2020-15200) resides in the RaggedCountSparseOutput implementation of TensorFlow. It fails to validate the input arguments, specifically the splits tensor, which is used to partition the values tensor. This lack of validation can lead to a heap buffer overflow. An attacker could exploit this vulnerability by providing malicious input, causing a segmentation fault or potentially executing arbitrary code. The issue has been patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is addressed in TensorFlow version 2.3.1.
How To Fix
Minimum fixed version
2.3.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the patched version of TensorFlow as soon as possible.
Conclusion
In conclusion, the vulnerability (CVE-2020-15200) in TensorFlow prior to version 2.3.1 allows for a heap buffer overflow. This can be exploited by an attacker to cause a segmentation fault or potentially execute arbitrary code. To mitigate the risk, it is crucial to upgrade to TensorFlow version 2.3.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides tools and resources for building and deploying machine learning models.
A heap buffer overflow occurs when a program writes data beyond the allocated memory buffer in the heap. This can lead to memory corruption and potentially allow an attacker to execute arbitrary code.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, the vulnerability has been patched in TensorFlow version 2.3.1. It is recommended to upgrade to this version or later to mitigate the risk.
No, there are no known workarounds for this vulnerability. Upgrading to the patched version of TensorFlow is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
