In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of its arguments. Although `reverse_index_map_t` and `grad_values_t` are accessed in a similar pattern, only `reverse_index_map_t` is validated to be of proper shape. Hence, malicious users can pass a bad `grad_values_t` to trigger an assertion failure in `vec`, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1."

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `SparseFillEmptyRowsGrad`
    implementation has incomplete validation of the shapes of its arguments. Although `reverse_index_map_t`
    and `grad_values_t` are accessed in a similar pattern, only `reverse_index_map_t` is validated to be of
    proper shape. Hence, malicious users can pass a bad `grad_values_t` to trigger an assertion failure in
    `vec`, causing denial of service in serving installations. The issue is patched in commit
    390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2,
    2.2.1, or 2.3.1." (CVE-2020-15194)

This update for tensorflow2 fixes the following issues :

  - updated to 2.1.2 with following fixes (boo#1177022) :

  - Fixes an undefined behavior causing a segfault in     tf.raw_ops.Switch (CVE-2020-15190)

  - Fixes three vulnerabilities in conversion to DLPack     format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)

  - Fixes two vulnerabilities in SparseFillEmptyRowsGrad     (CVE-2020-15194, CVE-2020-15195)

  - Fixes an integer truncation vulnerability in code using     the work sharder API (CVE-2020-15202)

  - Fixes a format string vulnerability in     tf.strings.as_string (CVE-2020-15203)

  - Fixes segfault raised by calling session-only ops in     eager mode (CVE-2020-15204)

  - Fixes data leak and potential ASLR violation from     tf.raw_ops.StringNGrams (CVE-2020-15205)

  - Fixes segfaults caused by incomplete SavedModel     validation (CVE-2020-15206)

  - Fixes a data corruption due to a bug in negative     indexing support in TFLite (CVE-2020-15207)

  - Fixes a data corruption due to dimension mismatch in     TFLite (CVE-2020-15208)

  - Fixes several vulnerabilities in TFLite saved model     format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)

ID	Name	Product	Family	Severity
413373	SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-9mqp-7v2h-2382)	Tenable Cloud Security	SCA Checks	medium
413373	SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-9mqp-7v2h-2382)	Tenable Self-Hosted Container Security	SCA Checks	medium
142135	openSUSE Security Update : tensorflow2 (openSUSE-2020-1766)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2020-15194

medium

Tenable Plugins

medium

medium

critical