CVE-2020-26267 Lack of validation in data format attributes in TensorFlow

2020-12-1022:10:40

CWE-125

GitHub_M

www.cve.org

tensorflow

validation

data format

vulnerability

versions 1.15.5

2.0.4

2.1.3

2.2.2

2.3.2

2.4.0

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

18.0%

JSON

In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

CNA Affected

[
  {
    "product": "tensorflow",
    "vendor": "tensorflow",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.15.5"
      },
      {
        "status": "affected",
        "version": ">= 2.0.0, < 2.0.4"
      },
      {
        "status": "affected",
        "version": ">= 2.1.0, < 2.1.3"
      },
      {
        "status": "affected",
        "version": ">= 2.2.0, < 2.2.2"
      },
      {
        "status": "affected",
        "version": ">= 2.3.0, < 2.3.2"
      }
    ]
  }
]