TensorFlow up to 2.3.0 tf.raw_ops.StringNGrams data_splits memory corruption

Summaryinfo

A vulnerability, which was classified as critical, was found in TensorFlow up to 1.15.3/2.0.2/2.1.1/2.2.0/2.3.0. This affects the function tf.raw_ops.StringNGrams. Executing a manipulation of the argument data_splits as part of Argument can lead to memory corruption. This vulnerability is registered as CVE-2020-15205. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in TensorFlow up to 1.15.3/2.0.2/2.1.1/2.2.0/2.3.0 (Artificial Intelligence Software). This vulnerability affects the function tf.raw_ops.StringNGrams. The manipulation of the argument data_splits as part of a Argument leads to a memory corruption vulnerability. The CWE definition for the vulnerability is CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `data_splits` argument of `tf.raw_ops.StringNGrams` lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after `ee ff` are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

The weakness was published 09/25/2020 (GitHub Repository). The advisory is available at github.com. This vulnerability was named CVE-2020-15205 since 06/25/2020. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 1.15.4, 2.0.3, 2.1.2, 2.2.1 or 2.3.1 eliminates this vulnerability. Applying the patch 0462de5b544ed4731aa2fb23946ac22c01856b80 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Similar entries are available at VDB-162014, VDB-162013, VDB-162012 and VDB-162011. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Artificial Intelligence Software

Name

• TensorFlow

Version

• 1.15.0
• 1.15.1
• 1.15.2
• 1.15.3
• 2.0
• 2.0.0
• 2.0.1
• 2.0.2
• 2.1
• 2.1.0
• 2.1.1
• 2.2
• 2.2.0
• 2.3.0

License

• free

Website

• Product: https://github.com/tensorflow/tensorflow/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion