Strix
26.1K

CVE-2020-15190

MEDIUMCVSS 5.3/10EPSS 0.94%

Last modified

CVE-2020-15190 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. EPSS estimates a 0.94% chance of exploitation in the next 30 days.

Description

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is `nullptr`, hence we are binding a reference to `nullptr`. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. In this case, this results in a segmentation fault The issue is patched in commit da8558533d925694483d2c136a9220d6d49d843c, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Probability
0.94%

56.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
GoogleTensorflow< 1.15.4
GoogleTensorflow>= 2.0.0, < 2.0.3
GoogleTensorflow>= 2.1.0, < 2.1.2
GoogleTensorflow>= 2.2.0, < 2.2.1
GoogleTensorflow>= 2.3.0, < 2.3.1
OpensuseLeap15.2

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-15190?
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `tf.raw_ops.Switch` operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is `nullptr`, hence we are binding a reference to `nullptr`. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. In this case, this results in a segmentation fault The issue is patched in commit da8558533d925694483d2c136a9220d6d49d843c, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
How severe is CVE-2020-15190?
CVE-2020-15190 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.94% probability of exploitation in the next 30 days.
How do I fix CVE-2020-15190?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-15190?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST