Vulnerability · Published Sep 25, 2020 · Assigned by GitHub_M
CVE-2020-15210Segmentation fault in tensorflow-lite
Medium 6.5
In plain English
A medium-severity improper input validation in tensorflow from tensorflow. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and will release patch releases for all versions between 1.15 and 2.3. We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | tensorflow | 2.3.1 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow | 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 | PYSEC-2020-133 |
| PyPI | tensorflow | 1.15.4 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow | 2.0.3 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow | 2.1.2 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow | 2.2.1 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow-cpu | 2.0.3 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow-cpu | 2.3.1 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow-cpu | 1.15.4 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow-cpu | 2.1.2 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow-cpu | 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 | PYSEC-2020-290 |
| PyPI | tensorflow-cpu | 2.2.1 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow-gpu | 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 | PYSEC-2020-325 |
| PyPI | tensorflow-gpu | 1.15.4 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow-gpu | 2.0.3 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow-gpu | 2.1.2 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow-gpu | 2.2.1 | GHSA-x9j7-x98r-r4w2 |
| PyPI | tensorflow-gpu | 2.3.1 | GHSA-x9j7-x98r-r4w2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tensorflow | tensorflow | < 1.15.4>= 2.0.0, < 2.0.3>= 2.1.0, < 2.1.2>= 2.2.0, < 2.2.1>= 2.3.0, < 2.3.1 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
References
- https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1 x_refsource_MISC
- https://github.com/tensorflow/tensorflow/security/advisories/GHSA-x9j7-x98r-r4w2 x_refsource_CONFIRM
- https://github.com/tensorflow/tensorflow/commit/d58c96946b2880991d63d1dacacb32f0a4dfa453 x_refsource_MISC
- openSUSE-SU-2020:1766 vendor-advisory, x_refsource_SUSE