CVE-2020-15204: TensorFlow Null Pointer Dereference Vulnerability
Summary
CVE-2020-15204: Segfault in Tensorflow. Affects tensorflow across 5 version ranges.
< 1.15.4
>= 2.0.0, < 2.0.3
>= 2.1.0, < 2.1.2
>= 2.2.0, < 2.2.1
>= 2.3.0, < 2.3.1
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · PyPI
The same CVE-2020-15204 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow supports both eager execution and graph execution modes, with eager mode allowing for more interactive and intuitive development. However, in versions prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1, TensorFlow does not properly set the session state in eager mode, leading to a null pointer dereference vulnerability.
Vulnerability Detail
The null pointer dereference vulnerability in TensorFlow occurs when calling tf.raw_ops.GetSessionHandle or tf.raw_ops.GetSessionHandleV2 in eager mode. Due to the absence of session state initialization, the ctx->session_state() function returns nullptr, resulting in a segmentation fault when the code attempts to dereference this null pointer. An attacker could potentially exploit this vulnerability to cause a denial of service (DoS) by crashing the application or execute arbitrary code in the context of the TensorFlow process.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.15.41.15.4 -
>= 2.0.0, < 2.0.32.0.3 -
>= 2.1.0, < 2.1.22.1.2 -
>= 2.2.0, < 2.2.12.2.1 -
>= 2.3.0, < 2.3.12.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can avoid using the affected functions (tf.raw_ops.GetSessionHandle and tf.raw_ops.GetSessionHandleV2) in eager mode. Instead, they can switch to graph execution mode or modify their code to utilize alternative functions that do not trigger the null pointer dereference vulnerability.
Conclusion
The null pointer dereference vulnerability in TensorFlow can be mitigated by updating to the patched versions. It is crucial to keep software dependencies up to date to ensure the security and stability of machine learning applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models.
A null pointer dereference vulnerability occurs when a program attempts to access or dereference a null pointer, resulting in a crash or potential code execution issues.
An attacker could exploit this vulnerability by crafting malicious input that triggers the null pointer dereference, potentially leading to a denial of service or arbitrary code execution.
No, only versions prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1 are affected. It is recommended to update to the patched versions to mitigate the vulnerability.
Users can update their TensorFlow installation by following the official upgrade instructions provided by TensorFlow. It is recommended to upgrade to versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
