TensorFlow up to 1.14 UnsortedSegmentSum Negative Number heap-based overflow

Summaryinfo

A vulnerability marked as critical has been reported in TensorFlow up to 1.14. This vulnerability affects the function UnsortedSegmentSum. Performing a manipulation as part of Negative Number results in heap-based overflow. This vulnerability is cataloged as CVE-2019-16778. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in TensorFlow up to 1.14 (Artificial Intelligence Software). This affects the function UnsortedSegmentSum. The manipulation as part of a Negative Number leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.

The weakness was shared 12/16/2019 (GitHub Repository). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2019-16778 since 09/24/2019. It is possible to initiate the attack remotely. A authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

Upgrading to version 1.15 or 2.0 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Artificial Intelligence Software

Name

• TensorFlow

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14

License

• free

Website

• Product: https://github.com/tensorflow/tensorflow/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion