Vulnerability · Published Dec 10, 2020 · Assigned by GitHub_M
CVE-2020-26269Heap out of bounds read in filesystem glob matching in TensorFlow
High 7.5
In plain English
A high-severity out-of-bounds read in tensorflow from tensorflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | tensorflow | 2.4.0 | GHSA-9jjw-hf72-3mxw |
| PyPI | tensorflow | 2.4.0 | PYSEC-2020-141 |
| PyPI | tensorflow-cpu | 2.4.0 | GHSA-9jjw-hf72-3mxw |
| PyPI | tensorflow-cpu | 2.4.0 | PYSEC-2020-300 |
| PyPI | tensorflow-gpu | 2.4.0 | GHSA-9jjw-hf72-3mxw |
| PyPI | tensorflow-gpu | 2.4.0 | PYSEC-2020-335 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tensorflow | tensorflow | .4.0rc* |
Weakness: CWE-125