CVE-2020-15212: TensorFlow Lite Segment Sum Write Out-of-Bounds Vulnerability
Summary
CVE-2020-15212: Out of bounds access in tensorflow-lite. Affects tensorflow across 2 version ranges.
>= 2.2.0, < 2.2.1
>= 2.3.0, < 2.3.1
Fixed in 2.2.1 or 2.3.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · PyPI
The same CVE-2020-15212 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow Lite is an open-source deep learning framework developed by Google. It is designed to run on resource-constrained devices and provides a lightweight solution for deploying machine learning models. TensorFlow Lite includes a feature called segment sum, which allows users to perform segment-wise summation operations on tensors. This feature is commonly used in various applications, such as natural language processing and computer vision. However, a vulnerability has been discovered in TensorFlow Lite versions 2.2.0 to 2.3.0, which can be exploited to trigger writes outside of the bounds of heap allocated buffers.
Vulnerability Detail
The vulnerability arises when negative elements are inserted in the segment ids tensor, which can be accessed by users with the appropriate permissions. By altering the output index and writing to the output data buffer, an attacker can potentially cause a segmentation fault or corrupt the memory. This vulnerability can be chained with other exploits to create more advanced attacks. The issue has been patched in TensorFlow versions 2.2.1 and 2.3.1. However, if segment ids are generated as outputs of a tensor during inference steps, there is no possible workaround, and users are advised to upgrade to the patched code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.12.2.1 -
>= 2.3.0, < 2.3.12.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If the segment ids are stored statically in the model, a custom Verifier can be added to the model loading code to ensure that all segment ids are positive. This validation step can help mitigate the vulnerability. Similarly, if the segment ids are generated at runtime between inference steps, a similar validation can be implemented. However, if the segment ids are generated as outputs of a tensor during inference steps, there are no possible workarounds.
Conclusion
The TensorFlow Lite Segment Sum Write Out-of-Bounds Vulnerability allows attackers to trigger writes outside of the bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. This can lead to a segmentation fault or memory corruption. Users are advised to upgrade to TensorFlow Lite versions 2.2.1 or 2.3.1 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow Lite is an open-source deep learning framework developed by Google. It is designed to run on resource-constrained devices and provides a lightweight solution for deploying machine learning models.
Segment sum is a feature in TensorFlow Lite that allows users to perform segment-wise summation operations on tensors. It is commonly used in applications such as natural language processing and computer vision.
The vulnerability occurs when negative elements are inserted in the segment ids tensor, which can be accessed by users with the appropriate permissions. By altering the output index and writing to the output data buffer, an attacker can trigger writes outside of the bounds of heap allocated buffers.
The vulnerability can result in a segmentation fault or memory corruption. It can also be chained with other vulnerabilities to create more advanced exploits.
The vulnerability can be mitigated by upgrading to TensorFlow Lite versions 2.2.1 or 2.3.1, which contain the necessary patches. Additionally, if the segment ids are stored statically in the model, a custom Verifier can be added to ensure that all segment ids are positive.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
