CVE-2020-15212 — Out-of-bounds Write in Google Tensorflow
Severity
8.6HIGHNVD
CNA8.1
EPSS
0.2%
top 53.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 25
Description
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `output_data` buffer. This might result in a segmentation fault but it can also be used to further corrupt the memory and can be chained with other vulnerabilities to create more advanced exploits. The issu…
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HExploitability: 3.9 | Impact: 4.7
Affected Packages3 packages
Patches
🔴Vulnerability Details
4📋Vendor Advisories
1Debian▶
CVE-2020-15212: tensorflow - In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can...↗2020