CVE-2020-15197 — Improper Input Validation in Intel Optimization FOR Tensorflow
Severity
6.3MEDIUMNVD
EPSS
0.2%
top 55.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 25
Description
In Tensorflow before version 2.3.1, the `SparseCountSparseOutput` implementation does not validate that the input arguments form a valid sparse tensor. In particular, there is no validation that the `indices` tensor has rank 2. This tensor must be a matrix because code assumes its elements are accessed as elements of a matrix. However, malicious users can pass in tensors of different rank, resulting in a `CHECK` assertion failure and a crash. This can be used to cause denial of service in servin…
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:HExploitability: 1.8 | Impact: 4.0
Affected Packages3 packages
Patches
🔴Vulnerability Details
4📋Vendor Advisories
1Debian▶
CVE-2020-15197: tensorflow - In Tensorflow before version 2.3.1, the `SparseCountSparseOutput` implementation...↗2020