Home

CVE-2020-15205

Description

In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the data_splits argument of tf.raw_ops.StringNGrams lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after ee ff are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR. The issue is patched in commit 0462de5b544ed4731aa2fb23946ac22c01856b80, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

Risk Information

Base Score
9.8
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.544

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities are fixed in Python-tensorflow 1.15.4Windows
Multiple vulnerabilities are fixed in Python-tensorflow 2.0.3Windows
Multiple vulnerabilities are fixed in Python-tensorflow 2.1.2Windows
Multiple vulnerabilities are fixed in Python-tensorflow 2.2.1Windows
Multiple vulnerabilities are fixed in Python-tensorflow 2.3.1Windows
Multiple vulnerabilities are fixed in Python-tensorflow-cpu 1.15.4Windows
Multiple vulnerabilities are fixed in Python-tensorflow-cpu 2.1.2Windows
Multiple vulnerabilities are fixed in Python-tensorflow-cpu 2.2.1Windows
Multiple vulnerabilities are fixed in Python-tensorflow-cpu 2.3.1Windows
Multiple vulnerabilities are fixed in Python-tensorflow-gpu 1.15.4Windows
Multiple vulnerabilities are fixed in Python-tensorflow-gpu 2.0.3Windows
Multiple vulnerabilities are fixed in Python-tensorflow-gpu 2.1.2Windows
Multiple vulnerabilities are fixed in Python-tensorflow-gpu 2.2.1Windows
Multiple vulnerabilities are fixed in Python-tensorflow-gpu 2.3.1Windows
Multiple vulnerabilities are fixed in Python-tensorflow for linux 1.15.4Linux
Multiple vulnerabilities are fixed in Python-tensorflow for linux 2.0.3Linux
Multiple vulnerabilities are fixed in Python-tensorflow for linux 2.1.2Linux
Multiple vulnerabilities are fixed in Python-tensorflow for linux 2.2.1Linux
Multiple vulnerabilities are fixed in Python-tensorflow for linux 2.3.1Linux
Multiple vulnerabilities are fixed in Python-tensorflow-cpu for linux 1.15.4Linux
Multiple vulnerabilities are fixed in Python-tensorflow-cpu for linux 2.1.2Linux
Multiple vulnerabilities are fixed in Python-tensorflow-cpu for linux 2.2.1Linux
Multiple vulnerabilities are fixed in Python-tensorflow-cpu for linux 2.3.1Linux
Multiple vulnerabilities are fixed in Python-tensorflow-gpu for linux 1.15.4Linux
Multiple vulnerabilities are fixed in Python-tensorflow-gpu for linux 2.0.3Linux
Multiple vulnerabilities are fixed in Python-tensorflow-gpu for linux 2.1.2Linux
Multiple vulnerabilities are fixed in Python-tensorflow-gpu for linux 2.2.1Linux
Multiple vulnerabilities are fixed in Python-tensorflow-gpu for linux 2.3.1Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234