CVE-2020-15204: medium-severity vulnerability in tensorflow
Segfault in Tensorflow
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
TensorFlow crashes with a segmentation fault when certain session handle functions are called in eager mode because the code tries to access memory that doesn't exist. This can cause applications using TensorFlow to unexpectedly stop working.
In eager mode, TensorFlow versions before 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1 fail to initialize session state, causing null pointer dereference when tf.raw_ops.GetSessionHandle or tf.raw_ops.GetSessionHandleV2 are invoked. An attacker or malicious code with ability to call these functions can trigger a denial of service via segmentation fault.
In the same product, most dangerous first.