CVE-2020-15205

Data leak in Tensorflow

State: Published
Severity: 9.0 Critical
Published: Sep 25, 2020
Updated: Aug 4, 2024
Reserved: Jun 25, 2020

Description

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `data_splits` argument of `tf.raw_ops.StringNGrams` lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after `ee ff` are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Scores

CVSS	Score	Vector	Source
3.1	9.0 Critical	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-122 {"CWE-122":"Heap-based Buffer Overflow"}
CWE-119 {"CWE-119":"Improper Restriction of Operations within the Bounds of a Memory Buffer"}

Affected Products

Product	Versions
tensorflowtensorflow	< 1.15.4Affected >= 2.0.0, < 2.0.3Affected >= 2.1.0, < 2.1.2Affected >= 2.2.0, < 2.2.1Affected >= 2.3.0, < 2.3.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.