Out-of-bounds Write Affecting tensorflow package, versions [2.2.0, 2.2.1) [2.3.0, 2.3.1)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-TENSORFLOW-1013541
- published 28 Sep 2020
- disclosed 28 Sep 2020
- credit Aivul Team from Qihoo 360
Introduced: 28 Sep 2020
CVE-2020-15214 Open this link in a new tabHow to fix?
Upgrade tensorflow to version 2.2.1, 2.3.1 or higher.
Overview
tensorflow is a machine learning framework.
Affected versions of this package are vulnerable to Out-of-bounds Write. Models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the dimensionality of output tensor.This results in allocating insufficient memory for the output tensor and in a write outside the bounds of the output array.This usually results in a segmentation fault, but depending on runtime conditions it can provide for a write gadget to be used in future memory corruption-based exploits.e.