CVE-2020-15213

CVE-2020-15213 affects TensorFlow Lite prior to 2.2.1 and 2.3.1. The vulnerability arises in the segment_sum implementation: models that use segment sums can trigger a denial of service by causing an out-of-memory allocation. The root cause is that code uses the last element of the segment_ids te...

CVE-2020-15213 Denial of service in tensorflow-lite

In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a denial of service by causing an out of memory allocation in the implementation of segment sum. Since code uses the last element of the tensor holding them to determine the dimensionality of output tensor,...

CVE-2020-15213

In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a denial of service by causing an out of memory allocation in the implementation of segment sum. Since code uses the last element of the tensor holding them to determine the dimensionality of output tensor,...

CVE-2020-15214 Out of bounds write in tensorflow-lite

In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the...

CVE-2020-15214

CVE-2020-15214 affects TensorFlow Lite prior to 2.2.1 and 2.3.1. A write-out-of-bounds can occur when segment IDs are not sorted in segment_sum, due to memory allocation based on the last segment-id element, causing segmentation faults and potential memory corruption. The issue is patched in comm...

CVE-2020-15201

CVE-2020-15201 : TensorFlow before 2.3.1 contains a bounds-checking flaw in RaggedCountSparseOutput, where input ragged-tensor validation is missing. Specifically, values in the splits tensor may not form a valid partitioning of values, risking a heap-based buffer overflow if split_values does no...

CVE-2020-15201 Heap buffer overflow in Tensorflow

In Tensorflow before version 2.3.1, the RaggedCountSparseOutput implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the splits tensor generate a valid partitioning of the values tensor. Hence, the code is...

CVE-2020-15201

In Tensorflow before version 2.3.1, the RaggedCountSparseOutput implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the splits tensor generate a valid partitioning of the values tensor. Hence, the code is...

CVE-2020-15202 Integer truncation in Shard API usage

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the Shard API in TensorFlow expects the last argument to be a function taking two int64 i.e., long long arguments. However, there are several places in TensorFlow where a lambda taking int or int32 arguments is being used. In...

CVE-2020-15202

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the Shard API in TensorFlow expects the last argument to be a function taking two int64 i.e., long long arguments. However, there are several places in TensorFlow where a lambda taking int or int32 arguments is being used. In...

CVE-2020-15202

CVE-2020-15202 : TensorFlow Shard API truncation bug affects multiple releases (1.15.4, 2.0.3, 2.1.2, 2.2.1, 2.3.1). A lambda taking int/int32 instead of int64 in work-parallelization can cause integer truncation, leading to segfaults, out-of-bounds reads/writes, stack overflows, or data corrupti...

CVE-2020-15203

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.asstring, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentati...

CVE-2020-15203 Denial of Service in Tensorflow

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, by controlling the fill argument of tf.strings.asstring, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a printf call is constructed. This may result in segmentati...

CVE-2020-15203

CVE-2020-15203 is a TensorFlow format-string vulnerability in tf.strings.as_string triggered by the fill argument. The issue can cause segmentation faults and is fixed in TensorFlow releases 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1 (commit 33be22c65d86256e6826666662e40dbdfe70ee83). Public reference...

CVE-2020-15204

In eager mode, TensorFlow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1 does not set the session state. Hence, calling tf.rawops.GetSessionHandle or tf.rawops.GetSessionHandleV2 results in a null pointer dereference In linked snippet, in eager mode, ctx-sessionstate returns nullptr. Since...

CVE-2020-15204

CVE-2020-15204 affects TensorFlow in eager mode where a missing session_state leads to a null pointer dereference in tf.raw_ops.GetSessionHandle/GetSessionHandleV2, causing a segmentation fault (denial of service). The issue is fixed in commit 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1 and releases...

CVE-2020-15204 Segfault in Tensorflow

In eager mode, TensorFlow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1 does not set the session state. Hence, calling tf.rawops.GetSessionHandle or tf.rawops.GetSessionHandleV2 results in a null pointer dereference In linked snippet, in eager mode, ctx-sessionstate returns nullptr. Since...

CVE-2020-15205

CVE-2020-15205 affects TensorFlow: the data_splits parameter of tf.raw_ops.StringNGrams lacks validation, allowing crafted input that can cause heap overflow and memory leakage, potentially leaking memory contents and aiding ASLR defeat. Affected TF versions include 1.15.4 and 2.x releases up to ...

CVE-2020-15205

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the datasplits argument of tf.rawops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ...

CVE-2020-15205 Data leak in Tensorflow

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the datasplits argument of tf.rawops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ...