CVE-2020-26270 — Improper Input Validation in Tensorflow

CWE-20 — Improper Input Validation6 documents5 sources
Severity
3.3LOWNVD
CNA4.4
EPSS
0.0%
top 95.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
TensorflowGoogle TensorflowIntel Optimization FOR Tensorflow
Timeline
PublishedDec 10

Description

In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure when using the CUDA backend. This can result in a query-of-death vulnerability, via denial of service, if users can control the input to the layer. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 1.8 | Impact: 1.4

Affected Packages3 packages

▶NVDgoogle/tensorflow2.0.0 — 2.0.4+4
▶CVEListV5tensorflow/tensorflow< 1.15.5+4
▶PyPIintel/optimization_for_tensorflow2.0.0 — 2.0.4+5

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
CVE-2020-26270: In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU layer receives an input with zero-length results in a CHECK failure wh↗2020-12-10
▶
GHSA
CHECK-fail in LSTM with zero-length input in TensorFlow↗2020-12-10
▶
CVEList
CHECK-fail in LSTM with zero-length input in TensorFlow↗2020-12-10
▶
OSV
CHECK-fail in LSTM with zero-length input in TensorFlow↗2020-12-10
▶

📋Vendor Advisories

1
Debian
CVE-2020-26270: tensorflow - In affected versions of TensorFlow running an LSTM/GRU model where the LSTM/GRU ...↗2020
▶
CVE-2020-26270 — Improper Input Validation | cvebase