CVE-2020-26266 — Use of Uninitialized Resource

Vendor	Product	Version range	Fixed in
debian	tensorflow	—	—
google	tensorflow	< 1.15.5	1.15.5
google	tensorflow	>= 2.0.0 < 2.0.4	2.0.4
google	tensorflow	>= 2.1.0 < 2.1.3	2.1.3
google	tensorflow	>= 2.2.0 < 2.2.2	2.2.2
google	tensorflow	>= 2.3.0 < 2.3.2	2.3.2
intel	optimization_for_tensorflow	>= 0 < 1.15.5	1.15.5
intel	optimization_for_tensorflow	>= 0 < ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2	ace0c15a22f7f054abcc1f53eabbcb0a1239a9e2
intel	optimization_for_tensorflow	>= 2.0.0 < 2.0.4	2.0.4
intel	optimization_for_tensorflow	>= 2.1.0 < 2.1.3	2.1.3
intel	optimization_for_tensorflow	>= 2.2.0 < 2.2.2	2.2.2
intel	optimization_for_tensorflow	>= 2.3.0 < 2.3.2	2.3.2
tensorflow	tensorflow	< 1.15.5	1.15.5
tensorflow	tensorflow	—	—
tensorflow	tensorflow	—	—
tensorflow	tensorflow	—	—
tensorflow	tensorflow	—	—

Debian

CVE-2020-26266: tensorflow - In affected versions of TensorFlow under certain cases a saved model can trigger...

vendor_debian·2020·CVSS 4.4

CVE-2020-26266 [MEDIUM] CVE-2020-26266: tensorflow - In affected versions of TensorFlow under certain cases a saved model can trigger... In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0. Scope: local forky: resolved sid: resolved

OSV

Uninitialized memory access in TensorFlow

osv·2020-12-10

CVE-2020-26266 [MEDIUM] Uninitialized memory access in TensorFlow Uninitialized memory access in TensorFlow ### Impact Under certain cases, a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to [default initialize the quantized floating point types in Eigen](https://github.com/tensorflow/tensorflow/blob/f70160322a579144950dff1537dcbe3c7c09d6f5/third_party/eigen3/unsupported/Eigen/CXX11/src/FixedPoint/FixedPointTypes.h#L61-L104): ```cc struct QUInt8 { QUInt8() {} // ... uint8_t value; }; struct QInt16 { QInt16() {} // ... int16_t value; }; struct QUInt16 { QUInt16() {} // ... uint16_t value; }; struct QInt32 { QInt32() {} // ... int32_t value; }; ``` ### Patches We have patched the issue in GitHub commit [ace0c15a22f7f054abcc

GHSA

Uninitialized memory access in TensorFlow

ghsa·2020-12-10

CVE-2020-26266 [MEDIUM] CWE-908 Uninitialized memory access in TensorFlow Uninitialized memory access in TensorFlow ### Impact Under certain cases, a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to [default initialize the quantized floating point types in Eigen](https://github.com/tensorflow/tensorflow/blob/f70160322a579144950dff1537dcbe3c7c09d6f5/third_party/eigen3/unsupported/Eigen/CXX11/src/FixedPoint/FixedPointTypes.h#L61-L104): ```cc struct QUInt8 { QUInt8() {} // ... uint8_t value; }; struct QInt16 { QInt16() {} // ... int16_t value; }; struct QUInt16 { QUInt16() {} // ... uint16_t value; }; struct QInt32 { QInt32() {} // ... int32_t value; }; ``` ### Patches We have patched the issue in GitHub commit [ace0c15a22f7f054abcc

OSV

CVE-2020-26266: In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution

osv·2020-12-10

CVE-2020-26266 CVE-2020-26266: In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

CVE-2020-26266: In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having…

Affected