Lack of validation in data format attributes in TensorFlow

🗓️ 10 Dec 2020 19:07:26Reported by GitHub Advisory DatabaseType

Lack of validation in data format attributes in TensorFlow. Unchecked assumptions in `tf.raw_ops.DataFormatVecPermute` and `tf.raw_ops.DataFormatDimMap` may result in memory access issues and crashes. Patched in GitHub commit ebc70b7a. Impacts TF versions 1.15 to 2.3

Reporter	Title	Published	Views	Family All 117
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in TensorFlow	27 Feb 202103:40	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple TensorFlow Vulnerabilities Affect IBM Watson Machine Learning on CP4D	30 Jul 202105:03	–	ibm
IBM Security Bulletins	Security Bulletin: TensorFlow in Watson Machine Learning Community Edition 1.6.2 and 1.7.0 has been patched for various security issues.	4 Feb 202122:54	–	ibm
ArchLinux	[ASA-202012-22] tensorflow: multiple issues	16 Dec 202000:00	–	archlinux
Circl	CVE-2020-26267	11 Dec 202002:34	–	circl
CNNVD	Google TensorFlow 缓冲区错误漏洞	10 Dec 202000:00	–	cnnvd
CNVD	Google TensorFlow Buffer Overflow Vulnerability (CNVD-2021-00091)	15 Dec 202000:00	–	cnvd
CVE	CVE-2020-26267	10 Dec 202022:10	–	cve
Cvelist	CVE-2020-26267 Lack of validation in data format attributes in TensorFlow	10 Dec 202022:10	–	cvelist
Debian CVE	CVE-2020-26267	10 Dec 202022:10	–	debiancve

Vulners

Node

tensorflow-gpuRange2.3.0–2.3.2pip

tensorflow-gpuRange2.2.0–2.2.2pip

tensorflow-gpuRange2.1.0–2.1.3pip

tensorflow-gpuRange2.0.0–2.0.4pip

tensorflow-gpuRange<1.15.5pip

tensorflow-cpuRange2.3.0–2.3.2pip

tensorflow-cpuRange2.2.0–2.2.2pip

tensorflow-cpuRange2.1.0–2.1.3pip

tensorflow-cpuRange2.0.0–2.0.4pip

tensorflow-cpuRange<1.15.5pip

tensorflow tensorflowRange2.3.0–2.3.2pip

tensorflow tensorflowRange2.2.0–2.2.2pip

tensorflow tensorflowRange2.1.0–2.1.3pip

tensorflow tensorflowRange2.0.0–2.0.4pip

tensorflow tensorflowRange<1.15.5pip

Source	Link
github	www.github.com/tensorflow/tensorflow/security/advisories/GHSA-c9f3-9wfr-wgh7
github	www.github.com/tensorflow/tensorflow/commit/ebc70b7a592420d3d2f359e4b1694c236b82c7ae
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-26267
github	www.github.com/pypa/advisory-database/tree/main/vulns/tensorflow-cpu/PYSEC-2020-298.yaml
github	www.github.com/pypa/advisory-database/tree/main/vulns/tensorflow-gpu/PYSEC-2020-333.yaml
github	www.github.com/pypa/advisory-database/tree/main/vulns/tensorflow/PYSEC-2020-140.yaml
github	www.github.com/advisories/GHSA-c9f3-9wfr-wgh7

28 Oct 2024 20:02Current

2.1Low risk

Vulners AI Score2.1

CVSS 24.3

CVSS 3.14.4 - 7.8

EPSS0.00018

CWE-125