CVE-2020-15202
Integer truncation in Shard API usage
In short
TensorFlow's Shard API has a bug where functions expecting 64-bit integers receive 32-bit integers instead, causing data to be truncated when processing large amounts of work. This can lead to crashes, memory corruption, or data being read/written to the wrong locations.
Technical detail
Integer truncation vulnerability in TensorFlow's Shard API occurs when lambdas with int32 parameters are passed instead of required int64 parameters; when parallelized workload exceeds 32-bit range, truncation causes out-of-bounds heap access, stack overflow, or memory corruption. Requires TensorFlow versions before 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1 with affected Shard API calls.
Summary generated and translated by AI from the official description.
In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `Shard` API in TensorFlow expects the last argument to be a function taking two `int64` (i.e., `long long`) arguments. However, there are several places in TensorFlow where a lambda taking `int` or `int32` arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption. The issue is patched in commits 27b417360cbd671ef55915e4bb6bb06af8b8a832 and ca8c013b5e97b1373b3bb1c97ea655e69f31a575, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
tensorflow · tensorflowWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00065.htmlhttps://github.com/tensorflow/tensorflow/commit/27b417360cbd671ef55915e4bb6bb06af8b8a832https://github.com/tensorflow/tensorflow/commit/ca8c013b5e97b1373b3bb1c97ea655e69f31a575https://github.com/tensorflow/tensorflow/releases/tag/v2.3.1https://github.com/tensorflow/tensorflow/security/advisories/GHSA-h6fg-mjxg-hqq4