CVE-2020-15203: high-severity vulnerability in tensorflow
Denial of Service in Tensorflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in TensorFlow's string formatting function allows attackers to crash the application by injecting malicious format strings. This causes the program to stop working (denial of service).
A format string vulnerability exists in tf.strings.as_string() where the `fill` parameter is improperly sanitized before being used in a printf-style call. An attacker who can control this parameter can trigger memory corruption leading to segmentation faults and denial of service. The vulnerability affects TensorFlow versions prior to 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1.
In the same product, most dangerous first.