CVE-2020-15193: TensorFlow GPU - Uninitialized Memory Corruption
Summary
CVE-2020-15193: In Tensorflow before versions 2.2.1 and 2.3.1, the implementation of dlpack.to_dlpack can be made to use uninitialized memory resulting in further memory corruption. Affects tensorflow-gpu across 3 version ranges.
< 2.2.1
>= 2.3.0rc0, < 2.3.1
< 22e07fb204386768e5bcbea563641ea11f96ceb8
Fixed in 2.2.1 or 2.3.1, depending on the release line you run. How to fix ↓
Also tracked for
- tensorflow · Bitnami
- tensorflow · PyPI
- tensorflow-cpu · PyPI
- tensorflow · PyPI
The same CVE-2020-15193 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TensorFlow GPU is a Python library for numerical computation that uses data flow graphs. It is widely used for machine learning and deep learning tasks. The library provides a comprehensive set of tools and APIs for building and training neural networks. However, versions before 2.2.1 and 2.3.1 are vulnerable to an uninitialized memory corruption issue.
Vulnerability Detail
The vulnerability in TensorFlow GPU arises from the implementation of dlpack.to_dlpack function. This function can be tricked into using uninitialized memory if a Python object is passed instead of a tensor. The pybind11 glue code assumes that the argument is a tensor, leading to a reinterpret_cast that fails when the object is not a TensorFlow Tensor. This uninitialized memory can result in further memory corruption, potentially leading to crashes or arbitrary code execution.
How To Fix
Latest published version: 2.12.0 as of 22 Oct 2026
pip install --upgrade "tensorflow-gpu==2.12.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.12.2.1pip install --upgrade "tensorflow-gpu==2.2.1" -
>= 2.3.0rc0, < 2.3.12.3.1pip install --upgrade "tensorflow-gpu==2.3.1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in TensorFlow GPU (CVE-2020-15193) exposes a risk of uninitialized memory corruption, potentially leading to crashes or arbitrary code execution. It is crucial to update TensorFlow GPU to version 2.2.1 or 2.3.1 to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for tensorflow-gpu →
FAQ
TensorFlow GPU is a Python library for numerical computation that is optimized for GPU acceleration. It provides tools and APIs for building and training neural networks.
Versions before 2.2.1 and 2.3.1 of TensorFlow GPU are affected by this vulnerability.
This vulnerability can lead to memory corruption, which may result in crashes or arbitrary code execution.
To fix this vulnerability, update TensorFlow GPU to version 2.2.1 or 2.3.1.
No specific workaround has been mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for tensorflow-gpu.
