CVE-2020-15191Improper Input Validation in Intel Optimization FOR Tensorflow

Severity
5.3MEDIUMNVD
EPSS
0.2%
top 52.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 25

Description

In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind to `nullptr` while setting a `status` variable to the error condition. However, this `status` argument is not properly checked. Hence, code following these methods will bind references to null pointers. This is undefined behavior and reported as an error if compiling with `-fsanitize=null`. The issue is patched in commit 22e07fb204386768e

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

PyPIintel/optimization_for_tensorflow2.2.02.2.1+4
NVDgoogle/tensorflow2.2.0, 2.3.0+1
CVEListV5tensorflow/tensorflow= 2.2.0, = 2.3.0+1
NVDopensuse/leap15.2

Patches

🔴Vulnerability Details

4
OSV
Undefined behavior in Tensorflow2020-09-25
OSV
CVE-2020-15191: In Tensorflow before versions 22020-09-25
CVEList
Undefined behavior in Tensorflow2020-09-25
GHSA
Undefined behavior in Tensorflow2020-09-25

📋Vendor Advisories

1
Debian
CVE-2020-15191: tensorflow - In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argum...2020
CVE-2020-15191 — Improper Input Validation in Intel | cvebase