CVE-2020-15205
Data leak in Tensorflow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `data_splits` argument of `tf.raw_ops.StringNGrams` lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after `ee ff` are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
En Tensorflow versiones anteriores a 1.15.4, 2.0.3, 2.1.2, 2.2.1 y 2.3.1, el argumento "data_splits" de "tf.raw_ops.StringNGrams" carece de comprobación. Esto permite a un usuario pasar valores que pueden causar errores de desbordamiento de la pila e incluso filtrar el contenido de la memoria. En el fragmento de código vinculado, todas las cadenas binarias después de "ee ff" son contenidos desde la pila de memoria. Dado que estos pueden contener direcciones de retorno, este filtrado de datos se puede utilizar para anular ASLR. El problema es parcheado en el commit 0462de5b544ed4731aa2fb23946ac22c01856b80 y es publicado en TensorFlow versiones 1.15.4, 2.0.3, 2.1.2, 2.2.1 o 2.3.1
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-06-25 CVE Reserved
- 2020-09-25 CVE Published
- 2023-06-11 EPSS Updated
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-122: Heap-based Buffer Overflow
- CWE-787: Out-of-bounds Write
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-g7p5-5759-qv46 | 2024-08-04 |
URL | Date | SRC |
---|---|---|
https://github.com/tensorflow/tensorflow/commit/0462de5b544ed4731aa2fb23946ac22c01856b80 | 2021-11-18 |
URL | Date | SRC |
---|---|---|
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html | 2021-11-18 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | < 1.15.4 Search vendor "Google" for product "Tensorflow" and version " < 1.15.4" | - |
Affected
| ||||||
Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | >= 2.0.0 < 2.0.3 Search vendor "Google" for product "Tensorflow" and version " >= 2.0.0 < 2.0.3" | - |
Affected
| ||||||
Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | >= 2.1.0 < 2.1.2 Search vendor "Google" for product "Tensorflow" and version " >= 2.1.0 < 2.1.2" | - |
Affected
| ||||||
Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | >= 2.2.0 < 2.2.1 Search vendor "Google" for product "Tensorflow" and version " >= 2.2.0 < 2.2.1" | - |
Affected
| ||||||
Google Search vendor "Google" | Tensorflow Search vendor "Google" for product "Tensorflow" | >= 2.3.0 < 2.3.1 Search vendor "Google" for product "Tensorflow" and version " >= 2.3.0 < 2.3.1" | - |
Affected
| ||||||
Opensuse Search vendor "Opensuse" | Leap Search vendor "Opensuse" for product "Leap" | 15.2 Search vendor "Opensuse" for product "Leap" and version "15.2" | - |
Affected
|