CVE-2020-15195: high-severity vulnerability in tensorflow
Heap buffer overflow in Tensorflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
TensorFlow's SparseFillEmptyRowsGrad function uses incorrect array indexing that allows access beyond allocated memory, potentially crashing the application or enabling arbitrary code execution.
CVE-2020-15195 exploits a double indexing vulnerability in SparseFillEmptyRowsGrad where reverse_index_map(i) can reference out-of-bounds memory in grad_values, causing a heap buffer overflow. An attacker with ability to provide malicious sparse tensor inputs can trigger memory corruption. The vulnerability affects TensorFlow versions prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1.
In the same product, most dangerous first.