In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices for the tensors, indexing into an array of tensors that is owned by the subgraph. This results in a pattern of double array indexing when trying to get the data of each tensor. However, some operators can have some tensors be optional. To handle this scenario, the flatbuffer model uses a negative `-1` value as index for these tensors. This results in special casing during validation at model loading time. Unfortunately, this means that the `-1` index is a valid tensor index for any operator, including those that don't expect optional inputs and including for output tensors. Thus, this allows writing and reading from outside the bounds of heap allocated arrays, although only at a specific offset from the start of these arrays. This results in both read and write gadgets, albeit very limited in scope. The issue is patched in several commits (46d5b0852, 00302787b7, e11f5558, cd31fd0ce, 1970c21, and fff2c83), and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that only operators which accept optional inputs use the `-1` special value and only for the tensors that they expect to be optional. Since this allow-list type approach is erro-prone, we advise upgrading to the patched code.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer
    format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators
    and each operator has a set of input/output tensors. The flatbuffer format uses indices for the tensors,
    indexing into an array of tensors that is owned by the subgraph. This results in a pattern of double array
    indexing when trying to get the data of each tensor. However, some operators can have some tensors be
    optional. To handle this scenario, the flatbuffer model uses a negative `-1` value as index for these
    tensors. This results in special casing during validation at model loading time. Unfortunately, this means
    that the `-1` index is a valid tensor index for any operator, including those that don't expect optional
    inputs and including for output tensors. Thus, this allows writing and reading from outside the bounds of
    heap allocated arrays, although only at a specific offset from the start of these arrays. This results in
    both read and write gadgets, albeit very limited in scope. The issue is patched in several commits
    (46d5b0852, 00302787b7, e11f5558, cd31fd0ce, 1970c21, and fff2c83), and is released in TensorFlow versions
    1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1. A potential workaround would be to add a custom `Verifier` to the
    model loading code to ensure that only operators which accept optional inputs use the `-1` special value
    and only for the tensors that they expect to be optional. Since this allow-list type approach is erro-
    prone, we advise upgrading to the patched code. (CVE-2020-15211)

This update for tensorflow2 fixes the following issues :

  - updated to 2.1.2 with following fixes (boo#1177022) :

  - Fixes an undefined behavior causing a segfault in     tf.raw_ops.Switch (CVE-2020-15190)

  - Fixes three vulnerabilities in conversion to DLPack     format (CVE-2020-15191, CVE-2020-15192, CVE-2020-15193)

  - Fixes two vulnerabilities in SparseFillEmptyRowsGrad     (CVE-2020-15194, CVE-2020-15195)

  - Fixes an integer truncation vulnerability in code using     the work sharder API (CVE-2020-15202)

  - Fixes a format string vulnerability in     tf.strings.as_string (CVE-2020-15203)

  - Fixes segfault raised by calling session-only ops in     eager mode (CVE-2020-15204)

  - Fixes data leak and potential ASLR violation from     tf.raw_ops.StringNGrams (CVE-2020-15205)

  - Fixes segfaults caused by incomplete SavedModel     validation (CVE-2020-15206)

  - Fixes a data corruption due to a bug in negative     indexing support in TFLite (CVE-2020-15207)

  - Fixes a data corruption due to dimension mismatch in     TFLite (CVE-2020-15208)

  - Fixes several vulnerabilities in TFLite saved model     format (CVE-2020-15209, CVE-2020-15210, CVE-2020-15211)

ID	Name	Product	Family	Type	Severity
414113	SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-cvpc-8phh-8f45)	Tenable Cloud Security	SCA Checks	Local	medium
414113	SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-cvpc-8phh-8f45)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
142135	openSUSE Security Update : tensorflow2 (openSUSE-2020-1766)	Nessus	SuSE Local Security Checks	Local	critical

Detections

Analytics

CVE-2020-15211

medium

Tenable Plugins

medium

medium

critical