CVE-2020-26268: TensorFlow - Memory Write Crash Vulnerability
Summary
CVE-2020-26268: Write to immutable memory region in TensorFlow. Affects tensorflow across 5 version ranges.
< 1.15.5
>= 2.0.0, < 2.0.4
>= 2.1.0, < 2.1.3
>= 2.2.0, < 2.2.2
>= 2.3.0, < 2.3.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow-gpu · PyPI
- tensorflow · PyPI
The same CVE-2020-26268 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow is an open-source machine learning framework developed by Google. It provides a comprehensive ecosystem of tools, libraries, and resources for building and deploying machine learning models. TensorFlow allows users to define and execute computational graphs, making it a popular choice for deep learning tasks. However, versions of TensorFlow prior to 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0 are vulnerable to a memory write crash issue.
Vulnerability Detail
The vulnerability in TensorFlow arises from the tf.raw_ops.ImmutableConst operation, which creates a constant tensor from a memory mapped file. When the tensor type is not an integral type, the operation crashes the Python interpreter as it attempts to write to the memory area. This issue can lead to a segmentation fault, causing the program to terminate unexpectedly. The allocator used to return the buffer data is not marked as returning an opaque handle, resulting in the crash. An attacker could potentially exploit this vulnerability to cause denial of service or execute arbitrary code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.15.51.15.5 -
>= 2.0.0, < 2.0.42.0.4 -
>= 2.1.0, < 2.1.32.1.3 -
>= 2.2.0, < 2.2.22.2.2 -
>= 2.3.0, < 2.3.22.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update TensorFlow to the fixed versions mentioned above.
Conclusion
The memory write crash vulnerability in TensorFlow can have severe consequences, including program crashes and potential code execution by attackers. It is highly recommended to update TensorFlow to versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, or 2.4.0 to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow →
FAQ
TensorFlow is an open-source machine learning framework developed by Google. It provides tools and resources for building and deploying machine learning models.
The vulnerability can lead to a memory write crash, causing the Python interpreter to crash and potentially allowing attackers to execute arbitrary code or cause denial of service.
Versions of TensorFlow prior to 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0 are affected by this vulnerability.
No, there are no known workarounds for this vulnerability. It is crucial to update TensorFlow to the fixed versions.
To update TensorFlow, you can use package managers like pip or conda. Run the appropriate command to upgrade TensorFlow to one of the fixed versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow.
