Out-of-bounds Write Affecting tensorflow package, versions [2.2.0, 2.2.1) [2.3.0, 2.3.1)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-TENSORFLOW-1013504
- published 28 Sep 2020
- disclosed 25 Sep 2020
- credit Unknown
Introduced: 25 Sep 2020
CVE-2020-15212 Open this link in a new tabHow to fix?
Upgrade tensorflow to version 2.2.1, 2.3.1 or higher.
Overview
tensorflow is a machine learning framework.
Affected versions of this package are vulnerable to Out-of-bounds Write. In TensorFlow Lite models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to segment_ids_data can alter output_index and then write to outside of output_data buffer.
This might result in a segmentation fault but it can also be used to further corrupt the memory and can be chained with other vulnerabilities to create more advanced exploits.