CVE-2020-15207: high-severity vulnerability in tensorflow
Segfault and data corruption in tensorflow-lite
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
TensorFlow Lite fails to properly validate array indices when converting negative values, allowing out-of-bounds memory access that can crash the application or corrupt data. This happens because a critical validation check only runs in debug mode, leaving production systems vulnerable.
The vulnerability exists in the `ResolveAxis` function which converts negative indices to positive ones without proper bounds checking in release builds (validation only present in debug builds via DCHECK). An attacker can supply crafted input with invalid negative indices to trigger out-of-bounds memory access, resulting in segmentation faults or data corruption. The issue affects TensorFlow Lite versions before 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1.
In the same product, most dangerous first.