CVE-2020-26270 CHECK-fail in LSTM with zero-length input in TensorFlow

2020-12-1022:10:23

CWE-20

GitHub_M

www.cve.org

tensorflow

lstm

zero-length

vulnerability

cuda

denial of service

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

5.4

Confidence

High

EPSS

Percentile

12.6%

JSON

In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

CNA Affected

[
  {
    "product": "tensorflow",
    "vendor": "tensorflow",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.15.5"
      },
      {
        "status": "affected",
        "version": ">= 2.0.0, < 2.0.4"
      },
      {
        "status": "affected",
        "version": ">= 2.1.0, < 2.1.3"
      },
      {
        "status": "affected",
        "version": ">= 2.2.0, < 2.2.2"
      },
      {
        "status": "affected",
        "version": ">= 2.3.0, < 2.3.2"
      }
    ]
  }
]