Denial of Service in Tensorflow

MEDIO 6.3CVE-2020-15197 · BIT-tensorflow-2020-15197 · GHSA-qc53-44cj-vfvx · Published 25/09/2020 · updated 17/06/2026

En resumen

CVE-2020-15197 es una vulnerabilidad MEDIO (CVSS 6.3) que afecta a tensorflow, tensorflow-cpu, tensorflow-gpu.
Probabilidad de explotación en los próximos 30 días (EPSS): 0.73%, mayor que el 54.4% de las vulnerabilidades.
Solución: actualizar a 2.3.1 o posterior.

Package	Affected versions	Patched versions
tensorflow PyPI	`≥ 2.3.0, < 2.3.1< 2.3.1`	`2.3.1`
tensorflow-cpu PyPI	`≥ 2.3.0, < 2.3.1< 2.3.1`	`2.3.1`
tensorflow-gpu PyPI	`≥ 2.3.0, < 2.3.1< 2.3.1`	`2.3.1`
tensorflow google	`= 2.3.0`	No fix yet

Description

Impact

The SparseCountSparseOutput implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the indices tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix: https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L185

However, malicious users can pass in tensors of different rank, resulting in a CHECK assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor.

Patches

We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

For more information

Please consult our security guide for more information regarding the security model and how to contact us with issues and questions.

Attribution

This vulnerability is a variant of GHSA-p5f8-gfw5-33w4

NVD description

In Tensorflow before version 2.3.1, the `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a `CHECK` assertion failure and a crash. This can be used to cause denial of service in serving installations, if users are allowed to control the components of the input sparse tensor. The issue is patched in commit 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and is released in TensorFlow version 2.3.1.