In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common
    dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes.
    Since the function always returns the dimension of the first tensor, malicious attackers can craft cases
    where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of
    bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is
    patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4,
    2.0.3, 2.1.2, 2.2.1, or 2.3.1. (CVE-2020-15208)

This update for tensorflow2 fixes the following issues :

  - updated to 2.1.2 with following fixes (boo#1177022) :

  - Fixes an undefined behavior causing a segfault in     tf.raw_ops.Switch (CVE-2020-15190)

  - Fixes three vulnerabilities in conversion to DLPack     format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)

  - Fixes two vulnerabilities in SparseFillEmptyRowsGrad     (CVE-2020-15194, CVE-2020-15195)

  - Fixes an integer truncation vulnerability in code using     the work sharder API (CVE-2020-15202)

  - Fixes a format string vulnerability in     tf.strings.as_string (CVE-2020-15203)

  - Fixes segfault raised by calling session-only ops in     eager mode (CVE-2020-15204)

  - Fixes data leak and potential ASLR violation from     tf.raw_ops.StringNGrams (CVE-2020-15205)

  - Fixes segfaults caused by incomplete SavedModel     validation (CVE-2020-15206)

  - Fixes a data corruption due to a bug in negative     indexing support in TFLite (CVE-2020-15207)

  - Fixes a data corruption due to dimension mismatch in     TFLite (CVE-2020-15208)

  - Fixes several vulnerabilities in TFLite saved model     format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)

ID	Name	Product	Family	Severity
417197	SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-mxjj-953w-2c2v)	Tenable Cloud Security	SCA Checks	high
417197	SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-mxjj-953w-2c2v)	Tenable Self-Hosted Container Security	SCA Checks	high
142135	openSUSE Security Update : tensorflow2 (openSUSE-2020-1766)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2020-15208

high

Tenable Plugins

high

high

critical