Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. tensorflow-gpu
  4. ›
  5. CVE-2020-15208

CVE-2020-15208: Data corruption in tensorflow-lite

September 25, 2020 (updated October 30, 2024)

When determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/types.h#L437-L442

Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors.

References

  • github.com/advisories/GHSA-mxjj-953w-2c2v
  • github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-288.yaml
  • github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-323.yaml
  • github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-131.yaml
  • github.com/tensorflow/tensorflow
  • github.com/tensorflow/tensorflow/commit/8ee24e7949a203d234489f9da2c5bf45a7d5157d
  • github.com/tensorflow/tensorflow/releases/tag/v2.3.1
  • github.com/tensorflow/tensorflow/security/advisories/GHSA-mxjj-953w-2c2v
  • nvd.nist.gov/vuln/detail/CVE-2020-15208

Code Behaviors & Features

Detect and mitigate CVE-2020-15208 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 1.15.4, all versions starting from 2.0.0 before 2.0.3, all versions starting from 2.1.0 before 2.1.2, all versions starting from 2.2.0 before 2.2.1, version 2.2.0, all versions starting from 2.3.0 before 2.3.1, version 2.3.0

Fixed versions

  • 1.15.4
  • 2.0.3
  • 2.1.2
  • 2.2.1
  • 2.3.1

Solution

Upgrade to versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1 or above.

Impact 9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Learn more about CVSS

Weakness

  • CWE-125: Out-of-bounds Read
  • CWE-787: Out-of-bounds Write

Source file

pypi/tensorflow-gpu/CVE-2020-15208.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:09 +0000.