CVE-2020-15192

published 2020-09-25

CVE-2020-15192: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation…

Priority P4 19 medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I N A L

In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation failure. The issue occurs because the `status` argument during validation failures is not properly checked. Since each of the above methods can return an error status, the `status` value must be checked before continuing. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	tensorflow	—	—
google	tensorflow	—	—
google	tensorflow	—	—
intel	optimization_for_tensorflow	>= 0 < 22e07fb204386768e5bcbea563641ea11f96ceb8	22e07fb204386768e5bcbea563641ea11f96ceb8
intel	optimization_for_tensorflow	>= 0 < 2.2.1	2.2.1
intel	optimization_for_tensorflow	>= 2.2.0 < 2.2.1	2.2.1
intel	optimization_for_tensorflow	>= 2.3.0 < 2.3.1	2.3.1
intel	optimization_for_tensorflow	>= 2.3.0rc0 < 2.3.1	2.3.1
opensuse	leap	—	—
tensorflow	tensorflow	—	—
tensorflow	tensorflow	—	—

CVSS provenance

nvd v3.1 4.3 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

nvd v2.0 4.0 MEDIUM AV:N/AC:L/Au:S/C:N/I:N/A:P

vendor_debian 4.3 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20