CVE-2020-26266: TensorFlow - Uninitialized Values in Saved Model Execution
Summary
CVE-2020-26266: Uninitialized memory access in Eigen types in TensorFlow. Affects tensorflow across 5 version ranges.
< 1.15.5
>= 2.0.0, < 2.0.4
>= 2.1.0, < 2.1.3
>= 2.2.0, < 2.2.2
>= 2.3.0, < 2.3.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · PyPI
The same CVE-2020-26266 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow allows users to define and train neural networks using high-level APIs, making it accessible to both beginners and experts in the field. However, certain versions of TensorFlow are susceptible to a vulnerability that can lead to the use of uninitialized values during code execution.
Vulnerability Detail
The vulnerability in TensorFlow arises from tensor buffers being filled with the default value of the type but failing to default initialize the quantized floating point types in Eigen. This can result in the use of uninitialized values during the execution of a saved model. The impact of this vulnerability can vary depending on the specific use case, but it has the potential to lead to incorrect or unpredictable behavior in machine learning models. The vulnerability has been assigned the identifier CVE-2020-26266.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.15.51.15.5 -
>= 2.0.0, < 2.0.42.0.4 -
>= 2.1.0, < 2.1.32.1.3 -
>= 2.2.0, < 2.2.22.2.2 -
>= 2.3.0, < 2.3.22.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update TensorFlow to a fixed version.
Conclusion
The vulnerability in TensorFlow that allows the use of uninitialized values during code execution can have significant implications for machine learning models. It is crucial to update TensorFlow to one of the fixed versions to mitigate the risk of encountering this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides tools and resources for building and deploying machine learning models.
The vulnerability can lead to the use of uninitialized values during code execution, potentially resulting in incorrect or unpredictable behavior in machine learning models.
To fix this vulnerability, update TensorFlow to one of the recommended versions: 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, or 2.4.0.
There are no specific workarounds mentioned for this vulnerability. Updating TensorFlow to a fixed version is the recommended approach.
For more information about this vulnerability, refer to the official documentation and release notes provided by the TensorFlow team.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
