CVE-2020-26269
published 2020-12-10CVE-2020-26269: In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out…
PriorityP336high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.66%
47.6th percentile
In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | tensorflow | — | — |
| tensorflow | — | — | |
| intel | optimization_for_tensorflow | >= 0 < 8b5b9dc96666a3a5d27fad7179ff215e3b74b67c | 8b5b9dc96666a3a5d27fad7179ff215e3b74b67c |
| intel | optimization_for_tensorflow | >= 2.4.0rc0 < 2.4.0 | 2.4.0 |
| tensorflow | tensorflow | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vendor_debian7.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
ghsa·2022-10-07
CVE-2020-26269 [HIGH] CWE-125 TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
### Impact
The general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of [the array holding the directories](https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L127):
```cc
if (!fs->Match(child_path, dirs[dir_index])) { ... }
```
Since `dir_index` is [unconditionaly incremented](https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L106) outside of the lambda function where the vulnerable pattern occurs, this results in an access out of bounds issue under certain scenarios. For example, if `/t
OSV
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
osv·2022-10-07
CVE-2020-26269 [HIGH] TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
TensorFlow vulnerable to heap out of bounds read in filesystem glob matching
### Impact
The general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of [the array holding the directories](https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L127):
```cc
if (!fs->Match(child_path, dirs[dir_index])) { ... }
```
Since `dir_index` is [unconditionaly incremented](https://github.com/tensorflow/tensorflow/blob/458c6260265c46ebaf18052d6c61aea4b6b40926/tensorflow/core/platform/file_system_helper.cc#L106) outside of the lambda function where the vulnerable pattern occurs, this results in an access out of bounds issue under certain scenarios. For example, if `/t
OSV
CVE-2020-26269: In TensorFlow release candidate versions 2
osv·2020-12-10
CVE-2020-26269 CVE-2020-26269: In TensorFlow release candidate versions 2
In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched.
Debian
CVE-2020-26269: tensorflow - In TensorFlow release candidate versions 2.4.0rc*, the general implementation fo...
vendor_debian·2020·CVSS 7.5
CVE-2020-26269 [HIGH] CVE-2020-26269: tensorflow - In TensorFlow release candidate versions 2.4.0rc*, the general implementation fo...
In TensorFlow release candidate versions 2.4.0rc*, the general implementation for matching filesystem paths to globbing pattern is vulnerable to an access out of bounds of the array holding the directories. There are multiple invariants and preconditions that are assumed by the parallel implementation of GetMatchingPaths but are not verified by the PRs introducing it (#40861 and #44310). Thus, we are completely rewriting the implementation to fully specify and validate these. This is patched in version 2.4.0. This issue only impacts master branch and the release candidates for TF version 2.4. The final release of the 2.4 release will be patched.
Scope: local
forky: resolved
sid: resolved
No detection rules found.
No public exploits indexed.
https://github.com/tensorflow/tensorflow/commit/8b5b9dc96666a3a5d27fad7179ff215e3b74b67chttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-9jjw-hf72-3mxwhttps://github.com/tensorflow/tensorflow/commit/8b5b9dc96666a3a5d27fad7179ff215e3b74b67chttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-9jjw-hf72-3mxw
2020-12-10
Published