Detections
Analytics
SCA: security update for tensorflow, tensorflow-cpu, tensorflow-gpu (GHSA-p2cq-cprg-frvm)
critical Tenable Self-Hosted Container Security Plugin ID 417216
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out
bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in
increasing order, using the last element of the tensor holding them to determine the dimensionality of
output tensor. This results in allocating insufficient memory for the output tensor and in a write outside
the bounds of the output array. This usually results in a segmentation fault, but depending on runtime
conditions it can provide for a write gadget to be used in future memory corruption-based exploits. The
issue is patched in commit 204945b19e44b57906c9344c0d00120eeeae178a and is released in TensorFlow versions
2.2.1, or 2.3.1. A potential workaround would be to add a custom `Verifier` to the model loading code to
ensure that the segment ids are sorted, although this only handles the case when the segment ids are
stored statically in the model. A similar validation could be done if the segment ids are generated at
runtime between inference steps. If the segment ids are generated as outputs of a tensor during inference
steps, then there are no possible workaround and users are advised to upgrade to patched code.
(CVE-2020-15214)
See Also
Plugin Details
Severity: Critical
ID: 417216
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
Percentile: 56.69
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2020-15214
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 9.1
Threat Score: 7.9
Threat Vector: CVSS:4.0/E:P
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 9/25/2020
Vulnerability Publication Date: 9/25/2020
Reference Information
CVE: CVE-2020-15214
cwe: CWE-787