Improper Input Validation Affecting tensorflow-cpu package, versions [,2.4.0rc0)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-TENSORFLOWCPU-1050395
- published 11 Dec 2020
- disclosed 10 Dec 2020
- credit Aivul Team from Qihoo 360
Introduced: 10 Dec 2020
CVE-2020-26268 Open this link in a new tabHow to fix?
Upgrade tensorflow-cpu to version 2.4.0rc0 or higher.
Overview
tensorflow-cpu is a machine learning framework.
Affected versions of this package are vulnerable to Improper Input Validation. The tf.raw_ops.ImmutableConst operation returns a constant tensor created from a memory mapped file which is assumed immutable. However, if the type of the tensor is not an integral type, the operation crashes the Python interpreter as it tries to write to the memory area:
If the file is too small, TensorFlow properly returns an error as the memory area has fewer bytes than what is needed for the tensor it creates. However, as soon as there are enough bytes, the above snippet causes a segmentation fault.