Data corruption in tensorflow-lite

KRITISCH 9.8CVE-2020-15208 · BIT-tensorflow-2020-15208 · GHSA-mxjj-953w-2c2v · Published 25/09/2020 · updated 17/06/2026

Kurz gesagt

CVE-2020-15208 ist eine Schwachstelle (KRITISCH (CVSS 9.8)) in tensorflow, tensorflow-cpu, tensorflow-gpu.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.91%, höher als bei 60.0% aller Schwachstellen.
Abhilfe: auf 2.0.3, 2.1.2, 2.2.1, 2.3.1 oder neuer aktualisieren.

Package	Affected versions	Patched versions
tensorflow PyPI	`≥ 2.0.0, < 2.0.3≥ 2.1.0, < 2.1.2≥ 2.2.0, < 2.2.1≥ 2.3.0, < 2.3.1< 1.15.4`	`2.0.32.1.22.2.12.3.11.15.4`
tensorflow-cpu PyPI	`≥ 2.0.0, < 2.0.3≥ 2.1.0, < 2.1.2≥ 2.2.0, < 2.2.1≥ 2.3.0, < 2.3.1< 1.15.4`	`2.0.32.1.22.2.12.3.11.15.4`
tensorflow-gpu PyPI	`≥ 2.0.0, < 2.0.3≥ 2.1.0, < 2.1.2≥ 2.2.0, < 2.2.1≥ 2.3.0, < 2.3.1< 1.15.4`	`2.0.32.1.22.2.12.3.11.15.4`
tensorflow google	`≥ 2.0.0, < 2.0.3≥ 2.1.0, < 2.1.2≥ 2.2.0, < 2.2.1≥ 2.3.0, < 2.3.1< 1.15.4`	`2.0.32.1.22.2.12.3.11.15.4`

Description

Impact

When determining the common dimension size of two tensors, TFLite uses a DCHECK which is no-op outside of debug compilation modes: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/types.h#L437-L442

Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors.

Patches

We have patched the issue in 8ee24e7949a20 and will release patch releases for all versions between 1.15 and 2.3.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

NVD description

In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.