CVE-2020-15192

published 2020-09-25

CVE-2020-15192: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation…

medium 4.3 CVSS 3.1

AV N AC L PR L UI N S U C N I N A L

In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to `dlpack.to_dlpack` there is a memory leak following an expected validation failure. The issue occurs because the `status` argument during validation failures is not properly checked. Since each of the above methods can return an error status, the `status` value must be checked before continuing. The issue is patched in commit 22e07fb204386768e5bcbea563641ea11f96ceb8 and is released in TensorFlow versions 2.2.1, or 2.3.1.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
debian	tensorflow	—	—
google	tensorflow	—	—
google	tensorflow	—	—
intel	optimization_for_tensorflow	>= 0 < 22e07fb204386768e5bcbea563641ea11f96ceb8	22e07fb204386768e5bcbea563641ea11f96ceb8
intel	optimization_for_tensorflow	>= 0 < 2.2.1	2.2.1
intel	optimization_for_tensorflow	>= 2.2.0 < 2.2.1	2.2.1
intel	optimization_for_tensorflow	>= 2.3.0 < 2.3.1	2.3.1
intel	optimization_for_tensorflow	>= 2.3.0rc0 < 2.3.1	2.3.1
opensuse	leap	—	—
tensorflow	tensorflow	—	—
tensorflow	tensorflow	—	—

CWE-20