NULL pointer dereference in Google Tensorflow
CVE-2020-15190
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is `nullptr`, hence we are binding a reference to `nullptr`. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. In this case, this results in a segmentation fault The issue is patched in commit da8558533d925694483d2c136a9220d6d49d843c, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.009 (59.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 59.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Google Tensorflow
- Tensorflow — versions < 1.15.4, >= 2.0.0, < 2.0.3, >= 2.1.0, < 2.1.2
- openSUSE Leap — versions 15.2
Weakness classification (CWE)
References
- github.com/tensorflow/tensorflow/security/advisories/GHSA-4g9f-63rx-5cw4 (Exploit, Third Party Advisory)
- github.com/tensorflow/tensorflow/releases/tag/v2.3.1 (Third Party Advisory)
- github.com/tensorflow/tensorflow/commit/da8558533d925694483d2c136a9220d6d49d843c (Patch, Third Party Advisory)
- lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.html (vendor-advisory, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-15190?
- CVE-2020-15190 is a medium-severity vulnerability in Google Tensorflow, classified under Improper Input Validation. CVSS score: 5.3/10. Published 2020-09-25.
- How severe is CVE-2020-15190?
- Medium severity. CVSS v3 base score is 5.3 out of 10.