CVE-2020-15194mediumCWE-20CWE-617

CVE-2020-15194: medium-severity vulnerability in tensorflow

Denial of Service in Tensorflow

Published · Updated

Follow this CVE+ Monitor tensorflow+ Monitor tensorflow

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 1.0%
In short

TensorFlow's SparseFillEmptyRowsGrad function doesn't properly validate one of its input parameters, allowing attackers to send malformed data that crashes the service and causes it to stop working.

Technical detail

The SparseFillEmptyRowsGrad operation in TensorFlow lacks adequate input validation for the grad_values_t parameter; an attacker can supply a tensor with incorrect shape, triggering an assertion failure that leads to denial of service in TensorFlow Serving instances. The vulnerability affects TensorFlow versions prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1.

Summary generated and translated by AI from the official description.
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of its arguments. Although `reverse_index_map_t` and `grad_values_t` are accessed in a similar pattern, only `reverse_index_map_t` is validated to be of proper shape. Hence, malicious users can pass a bad `grad_values_t` to trigger an assertion failure in `vec`, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
tensorflow · tensorflow
Related CVEs — tensorflow

In the same product, most dangerous first.

CVE-2020-15202CRITICALInteger truncation in Shard API usageEPSS 1.3%CVE-2020-15207HIGHSegfault and data corruption in tensorflow-liteEPSS 1.2%CVE-2022-23559HIGHInteger overflow in TFLiteEPSS 1.2%CVE-2022-23581MEDIUM`CHECK`-failures during Grappler's `IsSimplifiableReshape` in TensorflowEPSS 1.2%CVE-2022-23589MEDIUMNull pointer dereference in Grappler's `IsConstant` in TensorflowEPSS 1.1%CVE-2020-15205CRITICALData leak in TensorflowEPSS 1.0%