CVE-2020-15202

Name: CVE-2020-15202
Creator: NVD / NIST
Published: 2020-09-25T19:15:15.493+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9/10EPSS 1.23%

Last modified Jun 17, 2026

CVE-2020-15202 is a critical-severity vulnerability rated 9/10 on the CVSS scale. In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last argument to be a function taking two `int64` (i.e., `long long`) arguments. However, there are several places in TensorFlow where a lambda taking `int` or `int32` arguments is being used. EPSS estimates a 1.23% chance of exploitation in the next 30 days.

Description

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last argument to be a function taking two `int64` (i.e., `long long`) arguments. However, there are several places in TensorFlow where a lambda taking `int` or `int32` arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption. The issue is patched in commits 27b417360cbd671ef55915e4bb6bb06af8b8a832 and ca8c013b5e97b1373b3bb1c97ea655e69f31a575, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Metrics

CVSS 3.1

9/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Probability

1.23%

65.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Google	Tensorflow	< 1.15.4
Google	Tensorflow	>= 2.0.0, < 2.0.3
Google	Tensorflow	>= 2.1.0, < 2.1.2
Google	Tensorflow	>= 2.2.0, < 2.2.1
Google	Tensorflow	>= 2.3.0, < 2.3.1
Opensuse	Leap	15.2

References

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.htmlMailing List, Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/27b417360cbd671ef55915e4bb6bb06af8b8a832Patch, Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/ca8c013b5e97b1373b3bb1c97ea655e69f31a575Patch, Third Party Advisory
https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h6fg-mjxg-hqq4Exploit, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.htmlMailing List, Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/27b417360cbd671ef55915e4bb6bb06af8b8a832Patch, Third Party Advisory
https://github.com/tensorflow/tensorflow/commit/ca8c013b5e97b1373b3bb1c97ea655e69f31a575Patch, Third Party Advisory
https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1Third Party Advisory
https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h6fg-mjxg-hqq4Exploit, Third Party Advisory

Timeline

Published: Sep 25, 2020
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2020-15202?

How severe is CVE-2020-15202?

CVE-2020-15202 has a CVSS score of 9/10 (CRITICAL severity). The EPSS model estimates a 1.23% probability of exploitation in the next 30 days.

How do I fix CVE-2020-15202?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-15202?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST