CVE-2020-26269
published 2020-12-10CVE-2020-26269: In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out…
high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | — | — | |
| intel | optimization_for_tensorflow | >= 0 < 8b5b9dc96666a3a5d27fad7179ff215e3b74b67c | 8b5b9dc96666a3a5d27fad7179ff215e3b74b67c |
| intel | optimization_for_tensorflow | >= 2.4.0rc0 < 2.4.0 | 2.4.0 |
| tensorflow | tensorflow | — | — |
GHSA
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
ghsa·2022-10-07
CVE-2020-26269 [HIGH] CWE-125 TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
### Impact
The general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of [the array holding the directories](https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L127):
```cc
if (!fs->Match(child_path, dirs[dir_index])) { ... }
```
Since `dir_index` is [unconditionaly incremented](https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L106) outside of the lambda function where the vulnerable pattern occurs, this results in an access out of bounds issue under certain scenarios. For example, if `/t
OSV
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
osv·2022-10-07
CVE-2020-26269 [HIGH] TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
### Impact
The general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of [the array holding the directories](https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L127):
```cc
if (!fs->Match(child_path, dirs[dir_index])) { ... }
```
Since `dir_index` is [unconditionaly incremented](https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L106) outside of the lambda function where the vulnerable pattern occurs, this results in an access out of bounds issue under certain scenarios. For example, if `/t
OSV
CVE-2020-26269: In TensorFlow release candidate versions 2
osv·2020-12-10
CVE-2020-26269 CVE-2020-26269: In TensorFlow release candidate versions 2
In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched.
Debian
CVE-2020-26269: tensorflow - In TensorFlow release candidate versions 2.4.0rc*, the general implementation fo...
vendor_debian·2020·CVSS 7.5
CVE-2020-26269 [HIGH] CVE-2020-26269: tensorflow - In TensorFlow release candidate versions 2.4.0rc*, the general implementation fo...
In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched.
Scope: local
forky: resolved
sid: resolved
No detection rules found.
No public exploits indexed.
https://github.com/tensorflow/tensorflow/commit/8b5b9dc96666a3a5d27fad7179ff215e3b74b67chttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-9jjw-hf72-3mxwhttps://github.com/tensorflow/tensorflow/commit/8b5b9dc96666a3a5d27fad7179ff215e3b74b67chttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-9jjw-hf72-3mxw
2020-12-10
Published