Vulnerability · Published Sep 25, 2020 · Assigned by GitHub_M
CVE-2020-15203Denial of Service in Tensorflow
High 7.5
In plain English
A high-severity improper input validation in tensorflow from tensorflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the `fill` argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a `printf` call is constructed. This may result in segmentation fault. The issue is patched in commit 33be22c65d86256e6826666662e40dbdfe70ee83, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | tensorflow | 2.1.2 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow | 2.2.1 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow | 2.3.1 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow | 1.15.4 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow | 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 | PYSEC-2020-126 |
| PyPI | tensorflow | 2.0.3 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow-cpu | 2.3.1 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow-cpu | 1.15.4 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow-cpu | 2.0.3 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow-cpu | 2.1.2 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow-cpu | 2.2.1 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow-cpu | 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 | PYSEC-2020-283 |
| PyPI | tensorflow-gpu | 2.1.2 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow-gpu | 2.2.1 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow-gpu | 2.3.1 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow-gpu | 1.15.4 | GHSA-xmq7-7fxm-rr79 |
| PyPI | tensorflow-gpu | 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 | PYSEC-2020-318 |
| PyPI | tensorflow-gpu | 2.0.3 | GHSA-xmq7-7fxm-rr79 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tensorflow | tensorflow | < 1.15.4>= 2.0.0, < 2.0.3>= 2.1.0, < 2.1.2>= 2.2.0, < 2.2.1>= 2.3.0, < 2.3.1 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1 x_refsource_MISC
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-xmq7-7fxm-rr79 x_refsource_CONFIRM
- https://github.com/tensorflow/tensorflow/commit/33be22c65d86256e6826666662e40dbdfe70ee83 x_refsource_MISC
- openSUSE-SU-2020:1766 vendor-advisory, x_refsource_SUSE