CVE-2020-26266 — Use of Uninitialized Resource in Tensorflow

CWE-908 — Use of Uninitialized Resource6 documents5 sources
Severity
5.3MEDIUMNVD
CNA4.4
EPSS
0.1%
top 84.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
TensorflowGoogle TensorflowIntel Optimization FOR Tensorflow
Timeline
PublishedDec 10

Description

In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 1.8 | Impact: 3.4

Affected Packages3 packages

▶NVDgoogle/tensorflow2.0.0 — 2.0.4+4
▶CVEListV5tensorflow/tensorflow< 1.15.5+4
▶PyPIintel/optimization_for_tensorflow2.0.0 — 2.0.4+5

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Uninitialized memory access in TensorFlow↗2020-12-10
▶
GHSA
Uninitialized memory access in TensorFlow↗2020-12-10
▶
OSV
CVE-2020-26266: In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution↗2020-12-10
▶
CVEList
Uninitialized memory access in Eigen types in TensorFlow↗2020-12-10
▶

📋Vendor Advisories

1
Debian
CVE-2020-26266: tensorflow - In affected versions of TensorFlow under certain cases a saved model can trigger...↗2020
▶
CVE-2020-26266 — Use of Uninitialized Resource | cvebase