TensorFlow up to 2.2.0/2.3.0 dlpack.to_dlpack Status input validation

Summaryinfo

A vulnerability has been found in TensorFlow up to 2.2.0/2.3.0 and classified as problematic. Affected by this vulnerability is the function dlpack.to_dlpack. Performing a manipulation of the argument Status as part of Argument results in input validation. This vulnerability is reported as CVE-2020-15192. The attack is possible to be carried out remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in TensorFlow up to 2.2.0/2.3.0 (Artificial Intelligence Software). It has been classified as problematic. This affects the function dlpack.to_dlpack. The manipulation of the argument status as part of a Argument leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on availability. The summary by CVE is:

In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation failure. The issue occurs because the `status` argument during validation failures is not properly checked. Since each of the above methods can return an error status, the `status` value must be checked before continuing. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.

The weakness was disclosed 09/25/2020 (GitHub Repository). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2020-15192 since 06/25/2020. It is possible to initiate the attack remotely. A authentication is necessary for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 2.2.1 or 2.3.1 eliminates this vulnerability. Applying the patch 22e07fb204386768e5bcbea563641ea11f96ceb8 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

The entries VDB-162001, VDB-162000, VDB-161999 and VDB-161998 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Artificial Intelligence Software

Name

• TensorFlow

Version

• 2.0
• 2.1
• 2.2
• 2.2.0
• 2.3.0

License

• free

Website

• Product: https://github.com/tensorflow/tensorflow/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion